Attack detection method and device
By extracting SQL syntax information from the message and converting it into a fingerprint code for matching, the problem of not being able to identify polymorphic attacks in the existing technology is solved, and more efficient and accurate SQL injection attack detection is achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-26
- Publication Date
- 2026-04-03
AI Technical Summary
Existing SQL injection attack detection methods rely on attack keywords pre-configured by security personnel, which cannot identify attacks where attackers modify the keywords, resulting in poor security.
By extracting SQL syntax information from the message, converting it into a fingerprint code to be matched, and matching it with a preset fingerprint code database, attack messages are identified. A binary search method is used to improve search efficiency.
It can accurately identify modified SQL injection attacks, improving detection accuracy and security, reducing false positive rates, and detecting SQL variants and new types of attacks.
Smart Images
Figure CN121792178A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of communication technology, and in particular to an attack detection method and apparatus. Background Technology
[0002] Structured Query Language (SQL) injection attacks refer to the insertion of malicious SQL statements into the input parameters of an application, causing the backend server to parse and execute malicious commands. SQL injection attacks are one of the common methods used by hackers to attack databases.
[0003] To enhance database security, firewall devices need to detect SQL injection attacks. Current detection methods match keywords in the message with pre-configured attack keywords. If a match is found, the message is considered an attack. However, this approach relies on pre-configured attack keywords and the breadth of knowledge of security personnel. If attackers modify the keywords, the firewall may fail to detect the SQL injection attack, resulting in poor security. Summary of the Invention
[0004] The purpose of this application is to provide an attack detection method and apparatus to accurately identify SQL injection attacks and improve network security. The specific technical solution is as follows:
[0005] In a first aspect, embodiments of this application provide an attack detection method, including:
[0006] Receive the message to be detected;
[0007] Extract the detection fields from the payload portion of the message to be detected;
[0008] Identify the SQL syntax information in the detection field, convert the SQL syntax information into a fingerprint code to be matched, and the fingerprint code to be matched is used to represent the syntax structure of the SQL syntax information;
[0009] If the fingerprint code to be matched is the same as any fingerprint code in the preset fingerprint code library, then the message to be detected is determined to be an attack message. The preset fingerprint code library includes fingerprint codes generated in advance based on the SQL syntax information included in the attack sample message.
[0010] In one possible implementation, the SQL syntax information includes multiple SQL syntax symbols; the step of converting the SQL syntax information into a fingerprint code to be matched includes:
[0011] Each SQL syntax symbol among the plurality of SQL syntax symbols is converted into a token type to obtain a stream of tokens to be matched;
[0012] Normalize the token types included in the token stream to be matched;
[0013] The normalized token stream to be matched is converted into the fingerprint code to be matched.
[0014] In one possible implementation, converting each of the plurality of SQL syntax symbols into a token type includes:
[0015] Based on the pre-defined correspondence between SQL syntax symbols and token types, each SQL syntax symbol is converted into a token type.
[0016] In one possible implementation, after converting the SQL syntax information into a fingerprint code to be matched, the method further includes:
[0017] The fingerprint code to be matched is searched from the preset fingerprint code library using a binary search method;
[0018] If the fingerprint code to be matched is found, it is determined that there is a fingerprint code in the fingerprint code library that is the same as the fingerprint code to be matched.
[0019] In one possible implementation, after determining that the message to be detected is an attack message, the method further includes:
[0020] Output a matching log for the message to be detected, the matching log including the token stream to be matched.
[0021] Secondly, embodiments of this application provide an attack detection device, comprising:
[0022] The receiving module is used to receive the message to be detected;
[0023] The extraction module is used to extract the detection fields from the payload portion of the message to be detected;
[0024] A conversion module is used to identify the SQL syntax information in the detection field and convert the SQL syntax information into a fingerprint code to be matched, wherein the fingerprint code to be matched is used to represent the syntax structure of the SQL syntax information.
[0025] The determination module is used to determine that the message to be detected is an attack message if the fingerprint code to be matched is the same as any fingerprint code in the preset fingerprint code library. The preset fingerprint code library includes fingerprint codes generated in advance based on the SQL syntax information included in the attack sample message.
[0026] In one possible implementation, the SQL syntax information includes multiple SQL syntax symbols; the conversion module is specifically used for:
[0027] Each SQL syntax symbol among the plurality of SQL syntax symbols is converted into a token type to obtain a stream of tokens to be matched;
[0028] Normalize the token types included in the token stream to be matched;
[0029] The normalized token stream to be matched is converted into the fingerprint code to be matched.
[0030] In one possible implementation, the conversion module is specifically used for:
[0031] Based on the pre-defined correspondence between SQL syntax symbols and token types, each SQL syntax symbol is converted into a token type.
[0032] In one possible implementation, the device further includes a lookup module;
[0033] The search module is used to search for the fingerprint code to be matched from the preset fingerprint code library using a binary search method;
[0034] The determining module is further configured to, if the fingerprint code to be matched is found, determine that there exists a fingerprint code in the fingerprint code library that is the same as the fingerprint code to be matched.
[0035] In one possible implementation, the device further includes:
[0036] The output module is used to output a matching log for the message to be detected, the matching log including the token stream to be matched.
[0037] Thirdly, embodiments of this application provide a network device, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus;
[0038] Memory, used to store computer programs;
[0039] When a processor executes a program stored in memory, it implements the method described in the first aspect above.
[0040] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the method described in the first aspect above.
[0041] Fifthly, embodiments of this application also provide a computer program product containing instructions that, when run on a computer, cause the computer to perform any of the methods described above.
[0042] Using the above technical solution, after receiving the message to be detected, the detection fields of the payload are extracted, and the SQL syntax information in the detection fields is identified. The SQL syntax information is then converted into a fingerprint code to be matched. If the fingerprint code to be matched matches any fingerprint code in a preset fingerprint code library, the message to be detected can be determined to be an attack message. Since the fingerprint code to be matched represents the syntactic structure of the SQL syntax information, compared to directly matching keywords in the SQL statement, this embodiment abstracts the matching of fingerprint codes representing the syntactic structure. Even if the attacker modifies the keywords or other information, the attack message can still be identified using this method, enabling more accurate identification of SQL injection attacks and improving security.
[0043] Of course, implementing any product or method of this application does not necessarily require achieving all of the advantages described above at the same time. Attached Figure Description
[0044] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other embodiments can be obtained based on these drawings.
[0045] Figure 1 A flowchart illustrating an attack detection method provided in this application embodiment;
[0046] Figure 2 A schematic diagram of an intelligent engine framework provided in an embodiment of this application;
[0047] Figure 3 A flowchart illustrating another attack detection method provided in this application embodiment;
[0048] Figure 4 This is a schematic diagram of the structure of an attack detection device provided in an embodiment of this application;
[0049] Figure 5 This is a schematic diagram of the structure of a network device provided in an embodiment of this application. Detailed Implementation
[0050] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art based on this application are within the scope of protection of this application.
[0051] To facilitate understanding, the relevant technical terms involved in the embodiments of this application will be introduced first.
[0052] SQL injection attacks refer to the insertion of malicious SQL statements into the input parameters of an application, thereby enabling the backend server to execute the SQL statements and attack the database. For example, for a login URL to a Uniform Resource Locator (URL) such as http: / / 127.0.0.1 / sqltest / Less-1 / ?name=1&pwd=asd, when this URL is entered in a browser, it actually accesses the Less-1 resource on the server with IP address 127.0.0.1, and the input parameters passed are name=1 and pwd=asd, which indicate that the username is 1 and the password is asd.
[0053] After the backend server receives the input parameter, the actual code executed is a query statement, namely: $sql="SELECT FROM users WHERE name='$name' AND pwd='$pwd'". By appending the actual input parameter to this query statement, the query statement becomes: $sql="SELECT FROM users WHERE name='1' AND pwd='asd'".
[0054] Normally, successful login requires a correct username and password. However, if the backend server does not check the input parameters and sets the value of the above name parameter to "'1' OR 1=1; -", then appending this name parameter to the above query statement will result in: $sql="SELECT FROM users WHERE name='1' OR 1=1; --AND pwd='asd'".
[0055] In this query, "name='1' OR 1=1" means to query users whose name is '1' or match all users. ";" is the end character of the query statement, and "--" indicates that the following content is a comment. That is, "pwd='asd'" in the query statement will be ignored, so no username and password are required to log in to the server.
[0056] This application provides an attack detection method to detect SQL injection attacks. This method can be applied to firewall devices or security devices in a network. Specifically, firewall devices and security devices can be network devices such as switches or routers. The following description uses an application to a firewall device as an example. Figure 1 As shown, the method includes:
[0057] S101, Receive the message to be detected.
[0058] The message to be detected can be an HTTP message, an HTTPS message, or other messages that may pose a risk of SQL injection attacks.
[0059] S102. Extract the detection fields from the payload portion of the message to be detected.
[0060] The payload can be split into detection fields according to a preset splitting granularity. For example, the entire payload can be treated as a detection field, or the URI parameter of the payload can be used as a detection field.
[0061] Understandably, the detection field can be used as user input to detect whether there is an SQL injection attack in the user input.
[0062] S103. Identify the SQL syntax information in the detection field and convert the SQL syntax information into a fingerprint code to be matched. The fingerprint code to be matched is used to represent the syntax structure of the SQL syntax information.
[0063] The analyzer can identify SQL syntax information in the detection fields based on the default SQL syntax rules. The analyzer has a built-in complete knowledge base of syntax rules for query languages such as SQL and NoSQL, enabling it to identify various types of SQL syntax information based on this knowledge base.
[0064] S104. If the fingerprint code to be matched is the same as any fingerprint code in the preset fingerprint code library, then the message to be detected is determined to be an attack message. The preset fingerprint code library includes fingerprint codes generated in advance based on the SQL syntax information included in the attack sample message.
[0065] In this embodiment, various types of attack packets can be collected in advance, and then the SQL syntax information in the attack packets can be converted into fingerprint codes, and then the fingerprint codes can be added to a preset fingerprint code library.
[0066] After obtaining the fingerprint code to be matched, a binary search method can be used to search for the matching fingerprint code in a preset fingerprint code database. If the matching fingerprint code is found, it is determined that a fingerprint code with the same name exists in the fingerprint code database, thus confirming that the packet to be detected is an attack packet. The binary search method can improve the search efficiency, thereby increasing the packet detection speed.
[0067] This method, upon receiving a message to be detected, extracts the detection fields from the payload and identifies the SQL syntax information within them. The SQL syntax information is then converted into a fingerprint code to be matched. If the fingerprint code matches any fingerprint code in a preset fingerprint code library, the message to be detected can be identified as an attack message. Since the fingerprint code represents the syntactic structure of the SQL syntax information, compared to directly matching keywords in the SQL statement, this embodiment abstracts the process by matching the fingerprint code representing the syntactic structure. Even if an attacker modifies keywords or other information, this method can still identify the attack message, enabling more accurate identification of SQL injection attacks and improving security.
[0068] It should be noted that after determining that the packet to be detected is an attack packet, a matching log for the packet to be detected can also be output. This matching log includes the token stream to be matched. In this way, it can be clearly recorded what kind of syntax structure the packet to be detected was intercepted, which is helpful for subsequent security analysis.
[0069] In this embodiment, the SQL syntax information includes multiple SQL syntax symbols, such as string literals, comment blocks, and database identifiers (e.g., table names and column names). In this embodiment, the firewall device can also distinguish between identical characters inside and outside the string. For example, a single quote is a syntax symbol outside the string, but part of the string content inside the string.
[0070] Furthermore, it can recognize consecutive characters as single operators, such as ==, >=, <=>, ||, etc.
[0071] After identifying the SQL syntax information, the SQL syntax information is converted into a fingerprint code to be matched, which includes the following steps:
[0072] Step 1: Convert each SQL syntax symbol in the multiple SQL syntax symbols into a token type to obtain a stream of tokens to be matched.
[0073] Specifically, each SQL syntax symbol can be converted into a token type based on a preset correspondence between SQL syntax symbols and token types.
[0074] As an example, if the detection field includes 1' OR '1'='1, the SQL syntax information in the detection field can be identified as containing SQL syntax symbols, and each AQL syntax symbol can be converted into a token type.
[0075] For example, the token type corresponding to "1" is number;
[0076] The syntax type corresponding to “'” is single quotes.
[0077] The syntax type corresponding to "OR" is a logical operator. Although "OR" is inside quotes in the detection field, the analyzer can recognize that "OR" is an unclosed string. Based on the context, it can be determined that the single quote before "OR" is a syntax delimiter.
[0078] The token type corresponding to “1” is a string;
[0079] The token type corresponding to "=" is a comparison operator.
[0080] The token type corresponding to “'1” is an unclosed string.
[0081] Ultimately, the token stream generated based on this detection field can be represented as: numeric single quote logical operator string comparison operator string (unclosed).
[0082] Step 2: Normalize the token types included in the token stream to be matched.
[0083] Normalization refers to abstracting different token types and converting them into a unified form. For example, it can be converted into a unified placeholder, such as converting numbers into placeholder 'n' and strings into placeholder 'n'. This preserves only the syntactic structure of the SQL syntax information, namely the types and order of keywords and operators, thus stripping away the specific data that does not affect the identification of malicious semantics. This prevents attackers from bypassing detection by changing numerical values or string content.
[0084] Step 3: Convert the normalized token stream to be matched into a fingerprint code to be matched.
[0085] Among them, the token stream to be matched can be converted into a fingerprint code to be matched by a preset algorithm. For example, a hash algorithm can be used to calculate the hash value of the token stream to be matched and use the hash value as the fingerprint code to be matched, or the token stream to be matched can be converted into a fixed-length feature code and use the feature code as the fingerprint code to be matched.
[0086] As an example, suppose the detection field includes "admin --".
[0087] Convert “admin' --” into a stream of tokens to be matched: identifier (admin) single quote space comment character (--).
[0088] Then, the stream of tokens to be matched is normalized and can be abstracted into a type sequence: ID QUOTE SPACECOMMENT.
[0089] Then, the normalized type sequence is hashed to obtain the fingerprint code to be matched: F1A9, where F1A9 is a hypothetical hash value, used only as an example.
[0090] For example, suppose the detection field includes "xyz' #".
[0091] Convert "xyz' #" into a stream of tokens to be matched: identifier (xyz) single quote space comment character (#).
[0092] The stream of tokens to be matched is normalized and can be abstracted into a sequence of types: ID QUOTE SPACECOMMENT.
[0093] Then, the normalized type sequence is hashed to obtain the fingerprint code to be matched: F1A9.
[0094] As can be seen, the values of the two detection fields are completely different, but the results after normalization and the fingerprint encoding are the same, meaning the syntactic structure is identical. Therefore, even if an attacker modifies the value of a specific keyword, they still cannot bypass the detection.
[0095] For example, the detection field includes "name = 'John Doe'".
[0096] Convert "name = 'John Doe'" into a stream of tokens to be matched: identifier (name) equal sign space single quote string (John Doe) single quote.
[0097] Then, the stream of tokens to be matched is normalized and can be abstracted into a sequence of types: ID EQUAL SPACEQUOTE STRING QUOTE.
[0098] Then, the normalized type sequence is hashed to obtain the fingerprint code to be matched: 8B3C.
[0099] If 8B3C is not found in the preset fingerprint encoding library, it can be determined that the message to be detected is not an attack message, that is, the detection field belongs to a legitimate input.
[0100] Compared to related technologies that rely on regular expressions for matching to identify SQL injection attacks, this application uses a different method: matching the SQL syntax structure. This method offers stronger resistance to bypassing attacks. Even if the attacker modifies specific numerical values, the attack message can still be accurately detected. Furthermore, this application uses fingerprint encoding to represent the SQL syntax structure. Since fingerprint encoding is obtained by normalizing SQL syntax symbols, it is more abstract and unaffected by changes in specific data. Moreover, if a new type of attack occurs, it is only necessary to analyze the syntax structure and add the fingerprint encoding to the preset fingerprint encoding library, without having to write complex regular expressions, making the implementation simpler.
[0101] The embodiments of this application can be implemented using an intelligent engine framework, such as... Figure 2 As shown, the framework consists of four parts: preprocessing, detection algorithm, attack model, and result processing.
[0102] Preprocessing refers to extracting the detection fields from the payload portion of the message to be detected.
[0103] The detection algorithm refers to the process of analyzing the detection fields to obtain the fingerprint code to be matched.
[0104] The attack model includes a preset fingerprint encoding library, which can be used to match the fingerprint encoding to be detected, thereby identifying whether the message to be detected is an attack message.
[0105] Result processing refers to processing the message based on the detection result of the message to be detected. If the message to be detected is not an attack message, it is forwarded; if the message to be detected is an attack message, it is either discarded or forwarded based on the user configuration.
[0106] The specific attack detection process is as follows: Figure 3 As shown, it includes the following steps:
[0107] S301, Traffic Input, i.e., receiving the message to be detected.
[0108] S302. Extract the detection fields from the message to be detected.
[0109] S303, Extract SQL syntax information.
[0110] S304. Perform semantic intelligent analysis on the SQL syntax information to generate a token stream to be matched.
[0111] S305. Convert the token stream to be matched into the fingerprint code to be matched.
[0112] S306. Search for the fingerprint code to be matched in the preset fingerprint code library.
[0113] S307. Determine whether SQL injection exists in the message to be detected.
[0114] If yes, then execute S309; otherwise, execute S308.
[0115] If a matching fingerprint code is found in the preset fingerprint code database, it is determined that SQL injection exists in the message to be detected; if no matching fingerprint code is found in the preset fingerprint code database, it is determined that SQL injection does not exist in the message to be detected.
[0116] S308. Allow the message to be detected to pass.
[0117] S309. Output matching logs and perform security processing actions on the packets to be detected.
[0118] The security processing action involves forwarding or discarding the packet to be detected based on user configuration.
[0119] This method intelligently analyzes the content of web requests and responses, enabling network devices to intelligently assess attack threats. Compared to traditional detection methods, this method boasts high accuracy, low false positive rate, and high performance. Traditional methods can only detect common attacks, failing to detect SQL variant attacks and novel unknown attacks, and are prone to false blocking. The method provided in this application, by matching SQL syntax structures, can detect SQL variant attacks and novel attacks, avoiding false blocking caused by matching regular expressions, thus ensuring normal business operations. Furthermore, compared to traditional detection methods, this method achieves a significant improvement in detection time complexity, reducing it from O(N) to O(LOG(N)).
[0120] Corresponding to the above method embodiments, this application also provides an attack detection device, such as... Figure 4 As shown, the device includes:
[0121] Receiver module 401 is used to receive the message to be detected;
[0122] Extraction module 402 is used to extract the detection field from the payload portion of the message to be detected;
[0123] The conversion module 403 is used to identify the SQL syntax information in the detection field and convert the SQL syntax information into a fingerprint code to be matched, wherein the fingerprint code to be matched is used to represent the syntax structure of the SQL syntax information.
[0124] The determination module 404 is used to determine that the message to be detected is an attack message if the fingerprint code to be matched is the same as any fingerprint code in the preset fingerprint code library. The preset fingerprint code library includes fingerprint codes generated in advance based on the SQL syntax information included in the attack sample message.
[0125] Optionally, the SQL syntax information includes multiple SQL syntax symbols; the conversion module 403 is specifically used for:
[0126] Each SQL syntax symbol among the plurality of SQL syntax symbols is converted into a token type to obtain a stream of tokens to be matched;
[0127] Normalize the token types included in the token stream to be matched;
[0128] The normalized token stream to be matched is converted into the fingerprint code to be matched.
[0129] Optionally, the conversion module 403 is specifically used for:
[0130] Based on the pre-defined correspondence between SQL syntax symbols and token types, each SQL syntax symbol is converted into a token type.
[0131] Optionally, the device also includes a search module;
[0132] The search module is used to search for the fingerprint code to be matched from the preset fingerprint code library using a binary search method;
[0133] The determining module 404 is further configured to, if the fingerprint code to be matched is found, determine that there exists a fingerprint code in the fingerprint code library that is the same as the fingerprint code to be matched.
[0134] Optionally, the device further includes:
[0135] The output module is used to output a matching log for the message to be detected, the matching log including the token stream to be matched.
[0136] This application also provides a network device, such as... Figure 5 As shown, it includes a processor 501, a communication interface 502, a memory 503, and a communication bus 504, wherein the processor 501, the communication interface 502, and the memory 503 communicate with each other through the communication bus 504.
[0137] Memory 503 is used to store computer programs;
[0138] When the processor 501 executes the program stored in the memory 503, it implements the steps in the above method embodiments.
[0139] The communication bus mentioned in the above network devices can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used to represent it in the diagram, but this does not indicate that there is only one bus or one type of bus.
[0140] The communication interface is used for communication between the aforementioned network devices and other devices.
[0141] The memory may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.
[0142] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.
[0143] In another embodiment provided in this application, a computer-readable storage medium is also provided, which stores a computer program that, when executed by a processor, implements the steps of any of the attack detection methods described above.
[0144] In another embodiment provided in this application, a computer program product containing instructions is also provided, which, when run on a computer, causes the computer to execute any of the attack detection methods described above.
[0145] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., a solid-state disk (SSD)).
[0146] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.
[0147] The various embodiments in this specification are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the apparatus embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.
[0148] The above description is merely a preferred embodiment of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application are included within the scope of protection of this application.
Claims
1. An attack detection method, characterized in that, include: Receive the message to be detected; Extract the detection fields from the payload portion of the message to be detected; Identify the SQL syntax information in the detection field, convert the SQL syntax information into a fingerprint code to be matched, and the fingerprint code to be matched is used to represent the syntax structure of the SQL syntax information; If the fingerprint code to be matched is the same as any fingerprint code in the preset fingerprint code library, then the message to be detected is determined to be an attack message. The preset fingerprint code library includes fingerprint codes generated in advance based on the SQL syntax information included in the attack sample message.
2. The method according to claim 1, characterized in that, The SQL syntax information includes multiple SQL syntax symbols; the conversion of the SQL syntax information into a fingerprint code to be matched includes: Each SQL syntax symbol among the plurality of SQL syntax symbols is converted into a token type to obtain a stream of tokens to be matched; Normalize the token types included in the token stream to be matched; The normalized token stream to be matched is converted into the fingerprint code to be matched.
3. The method according to claim 2, characterized in that, The step of converting each SQL syntax symbol among the plurality of SQL syntax symbols into a token type includes: Based on the pre-defined correspondence between SQL syntax symbols and token types, each SQL syntax symbol is converted into a token type.
4. The method according to claim 1, characterized in that, After converting the SQL syntax information into a fingerprint code to be matched, the method further includes: The fingerprint code to be matched is searched from the preset fingerprint code library using a binary search method; If the fingerprint code to be matched is found, it is determined that there is a fingerprint code in the fingerprint code library that is the same as the fingerprint code to be matched.
5. The method according to any one of claims 1-4, characterized in that, After determining that the packet to be detected is an attack packet, the method further includes: Output a matching log for the message to be detected, the matching log including the token stream to be matched.
6. An attack detection device, characterized in that, include: The receiving module is used to receive the message to be detected; The extraction module is used to extract the detection fields from the payload portion of the message to be detected; A conversion module is used to identify the SQL syntax information in the detection field and convert the SQL syntax information into a fingerprint code to be matched, wherein the fingerprint code to be matched is used to represent the syntax structure of the SQL syntax information. The determination module is used to determine that the message to be detected is an attack message if the fingerprint code to be matched is the same as any fingerprint code in the preset fingerprint code library. The preset fingerprint code library includes fingerprint codes generated in advance based on the SQL syntax information included in the attack sample message.
7. The apparatus according to claim 6, characterized in that, The SQL syntax information includes multiple SQL syntax symbols; the conversion module is specifically used for: Each SQL syntax symbol among the plurality of SQL syntax symbols is converted into a token type to obtain a stream of tokens to be matched; Normalize the token types included in the token stream to be matched; The normalized token stream to be matched is converted into the fingerprint code to be matched.
8. The apparatus according to claim 7, characterized in that, The conversion module is specifically used for: Based on the pre-defined correspondence between SQL syntax symbols and token types, each SQL syntax symbol is converted into a token type.
9. The apparatus according to claim 6, characterized in that, The device also includes a search module; The search module is used to search for the fingerprint code to be matched from the preset fingerprint code library using a binary search method; The determining module is further configured to, if the fingerprint code to be matched is found, determine that there exists a fingerprint code in the fingerprint code library that is the same as the fingerprint code to be matched.
10. The apparatus according to any one of claims 6-9, characterized in that, The device further includes: The output module is used to output a matching log for the message to be detected, the matching log including the token stream to be matched.