Intelligent detection method and system for judging abnormal SQL (Structured Query Language) statement

Abstract

The invention discloses an intelligent detection method and system for abnormal SQL statement judgment, and the method comprises the steps: designing a CNN-LSTM dual-channel architecture and a cross-modal attention fusion layer through the introduction of a combined design of an abstract syntax tree, byte pair coding and a recurrent neural network, enabling the two networks to capture local and global features respectively, and carrying out the recognition of abnormal SQL statements. The feature weight is dynamically adjusted through an attention mechanism, deep interactive fusion is realized, a heterogeneous base learner cluster is constructed, a meta learner is constructed by extracting multi-dimensional scene features and introducing a multi-layer perceptron, the base learner weight adaptive to the scene is dynamically generated, and meanwhile, a judgment threshold value is adjusted in combination with actual requirements, so that scene self-adaptive accurate decision is realized; and finally, abnormal SQL detection is achieved. According to the method, the feature fusion defect is solved through a cross-modal dynamic attention mechanism, scene adaptive optimization is realized through a meta-learning-driven dynamic decision framework, and the diversity of the model is enhanced through cooperation of multi-scale embedding and differentiated training strategies.

Description

Technical Field

[0001] This invention relates to an intelligent detection method and system for identifying abnormal SQL statements, belonging to the field of database detection technology. Background Technology

[0002] Anomaly SQL statement detection technology is a crucial aspect of database security. Traditional methods primarily rely on manually defined rule bases or regular expression matching to detect SQL injection attacks by identifying known attack patterns (such as dangerous keywords like DROP TABLE and UNION SELECT). While these methods are intuitive and interpretable, they struggle to adapt to variations of SQL injection attacks (such as hexadecimal encoding and comment obfuscation). With advancements in natural language processing (NLP), deep learning has become the mainstream approach for automatic feature extraction: word embedding techniques (such as Word2Vec and FastText) can transform SQL keywords and operators into dense vectors, preserving semantic relevance (e.g., the syntactic proximity of SELECT and FROM); sequence models (such as CNN and RNN) can capture both the local syntactic structure of SQL (e.g., CNN identifying short-range patterns like WHERE id=1 AND) and global dependencies (e.g., RNN modeling long-range logic between clauses in SELECT ... FROM ... WHERE). However, SQL statements possess both the strict structural nature of programming languages ​​and the contextual semantics of natural language, making it difficult for a single model to fully cover their complex characteristics. This has led to ensemble learning becoming an important direction for improving detection robustness.

[0003] Current technologies for detecting anomalous SQL (Structured Query Language) queries face significant bottlenecks. Traditional methods heavily rely on manually designed features and require expert experience to build anomalous SQL feature library. This process is time-consuming, labor-intensive, and difficult to adapt to complex and ever-changing anomaly patterns (such as new types of SQL injection), resulting in weak feature generalization ability and a high false negative rate.

[0004] Therefore, there are three core problems that need to be solved in existing technologies:

[0005] First, at the feature learning level, the adaptability of deep learning models to SQL statements needs to be addressed.

[0006] Second, at the model optimization level, it is necessary to overcome the collaborative bottleneck of ensemble learning.

[0007] Third, at the application verification level, it is necessary to build an evaluation system for real-world scenarios. Summary of the Invention

[0008] Objective: In order to overcome the shortcomings of the existing technology, the present invention provides an intelligent detection method and system for judging abnormal SQL statements.

[0009] Technical solution: To solve the above technical problems, the technical solution adopted by the present invention is as follows:

[0010] Firstly, an intelligent detection method for identifying abnormal SQL statements, specifically including:

[0011] The original SQL statement is deeply preprocessed to obtain a vector sequence that integrates semantics and structure.

[0012] Input a vector sequence that integrates semantics and structure into a feature extraction network, and output local feature vectors, global feature vectors, and deeply fused feature vectors.

[0013] The local feature vector is input into the first base learner to obtain the first SQL statement anomaly probability. The global feature vector is input into the second base learner to obtain the second SQL statement anomaly probability. The deep fusion feature vector is input into the third base learner to obtain the third SQL statement anomaly probability.

[0014] The original SQL statement is input into the scene feature extractor to obtain a multidimensional feature vector. The multidimensional feature vector is then input into the meta-learner to obtain dynamic weights.

[0015] The anomaly probabilities of the first, second, and third SQL statements are weighted and aggregated with dynamic weights to obtain the final anomaly probability. The final anomaly probability is then compared with a threshold to obtain the final anomaly detection result.

[0016] Optionally, step 1 specifically includes:

[0017] The original SQL statement is parsed to generate an abstract syntax tree.

[0018] Obtain the sub-word embedding paths from the abstract syntax tree, and generate semantic vectors by querying the embedding table based on the keywords in the sub-word embedding paths.

[0019] Obtain the syntax tree embedding path of the abstract syntax tree, aggregate upwards from the leaf nodes to the expression nodes, and generate a structure vector.

[0020] The semantic vector and the structural vector are aligned and merged according to the node positions of the abstract syntax tree to obtain a vector sequence that combines semantics and structure.

[0021] Optionally, the feature extraction network includes: a convolutional neural network channel, a bidirectional long short-term memory network channel, and a cross-modal attention fusion layer.

[0022] In this process, a vector sequence that integrates semantics and structure is input into the convolutional neural network channel to obtain local feature vectors.

[0023] A vector sequence that integrates semantics and structure is input into a bidirectional long short-term memory network channel to obtain a global feature vector.

[0024] The local and global feature vectors are input into the cross-modal attention fusion layer to obtain a deep fused feature vector.

[0025] Optionally, the first base learner includes a fully connected network. The second base learner includes a support vector machine. The third base learner includes a random forest classifier.

[0026] Optionally, the multidimensional feature vector includes, but is not limited to, statement length, subquery depth, and keyword distribution.

[0027] Optionally, the meta-learner includes a multilayer perceptron.

[0028] Optionally, the expression for the final anomaly probability P_final is as follows:

[0029] P_final = W1×P1 + W2×P2 + W3×P3

[0030] Where W1 is the local dynamic weight, W2 is the global dynamic weight, W3 is the deep dynamic weight, P1 is the probability of an anomaly in the first SQL statement, P2 is the probability of an anomaly in the second SQL statement, and P3 is the probability of an anomaly in the third SQL statement.

[0031] Secondly, an intelligent detection device for identifying abnormal SQL statements specifically includes:

[0032] Deep preprocessing module: Used to perform deep preprocessing on the original SQL statement to obtain a vector sequence that integrates semantics and structure.

[0033] Feature extraction module: This module takes a sequence of vectors that fuse semantics and structure as input to the feature extraction network and outputs local feature vectors, global feature vectors, and deeply fused feature vectors.

[0034] The heterogeneous base learner cluster module is used to input local feature vectors into the first base learner to obtain the first SQL statement anomaly probability. It then inputs the global feature vectors into the second base learner to obtain the second SQL statement anomaly probability. Finally, it inputs the deep fusion feature vectors into the third base learner to obtain the third SQL statement anomaly probability.

[0035] Dynamic weight module: Used to input the original SQL statement into the scene feature extractor to obtain a multi-dimensional feature vector, and input the multi-dimensional feature vector into the meta-learner to obtain dynamic weights.

[0036] Weighted decision module: It is used to weight and aggregate the anomaly probabilities of the first SQL statement, the second SQL statement, and the third SQL statement with dynamic weights to obtain the final anomaly probability. The final anomaly probability is then compared with a threshold to obtain the final anomaly detection result.

[0037] Thirdly, a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements an intelligent detection method for determining abnormal SQL statements as described in any of the first aspects.

[0038] Fourthly, a computer device comprising:

[0039] Memory is used to store instructions.

[0040] A processor is configured to execute the instructions, causing the computer device to perform operations of an intelligent detection method for determining abnormal SQL statements as described in any of the first aspects.

[0041] Beneficial Effects: This invention provides an intelligent detection method and system for identifying abnormal SQL statements. It constructs an end-to-end detection system capable of adapting to diverse features and scenarios of abnormal SQL statements across the entire process. First, it addresses the issues of missed semantic variant detection and structural information loss in the preprocessing stage by introducing a combination of abstract syntax trees, byte-pair encoding, and recurrent neural networks. This achieves accurate capture of keyword semantic variants while fully preserving the hierarchical structural information of the SQL statement, laying a "semantic + structural" dual-dimensional foundation for subsequent processing. Second, it addresses the problems of incomplete capture of local and global features and fusion failure in the feature extraction stage by designing a CNN-LSTM dual-channel architecture and a cross-modal attention fusion layer. This allows the two networks to capture local and global features respectively, and dynamically adjusts feature weights through an attention mechanism to achieve deep interactive fusion. Finally, it addresses the issues of generalization failure in the classification stage. To address the issue of complementary strengths and weaknesses, this invention constructs a heterogeneous base learner cluster (fully connected network, SVM, random forest) and builds differentiated training datasets for each learner through autonomous sampling with replacement. This ensures diversity in model type and data distribution, achieving precise adaptation and complementary strengths across different feature patterns. Finally, it resolves the issues of poor scenario adaptation and false negative / false negative imbalance in the decision-making stage by extracting multi-dimensional scene features and introducing a multilayer perceptron to construct a meta-learner. This dynamically generates base learner weights adapted to specific scenarios and adjusts the judgment threshold based on actual needs, achieving accurate scenario-adaptive decision-making. Ultimately, this achieves the goal of "no blind spots, full-scenario, and high-precision" anomaly SQL detection. Compared to existing technologies, the advantages of this invention are:

[0042] 1. This invention addresses the shortcomings of feature fusion through a cross-modal dynamic attention mechanism. Traditional methods suffer from the loss of nested structure features due to mechanical splicing, while this technology dynamically adjusts the fusion ratio of local syntactic and global semantic features through cross-attention weights, automatically enhancing the global context modeling capability when parsing complex queries. This design enables the model to deeply understand the SQL hierarchical logic, significantly improving the accuracy of identifying hidden anomalies (such as deep subquery injection), and overcoming the shortcomings of existing technologies in parsing complex structures.

[0043] 2. To address the shortcomings of static integration strategies, a meta-learning-driven dynamic decision-making framework achieves scenario-adaptive optimization. Traditional hard voting treats all base models equally, ignoring the characteristic differences of different SQL structures. In contrast, this invention analyzes scenario features such as statement length and subquery depth, and the meta-learner generates base model weight coefficients that match the scenario in real time. This mechanism automatically enhances the decision weights of sequence models in long statements and increases the contribution of local feature models in short, fast attacks, thereby significantly reducing the risk of misjudgment in specific scenarios and enabling the detection system to adapt to dynamic environments.

[0044] 3. To overcome the limitations of feature homogenization, multi-scale embedding and differentiated training strategies are used synergistically to enhance model diversity. Existing technologies suffer from convergent perspectives of base learners due to shared word embeddings. This invention constructs a heterogeneous feature space through syntax tree-driven dual-path embedding (semantic variants + structural encoding), while simultaneously employing independent training sets to cut off the path of data homogenization. This dual protection enables base learners to form complementary advantages, significantly improving the system's generalization ability and detection robustness against unknown attack variants (such as semantic obfuscation injection), achieving a fundamental evolution in security protection capabilities. Attached Figure Description

[0045] Figure 1 This is a flowchart illustrating an intelligent detection method for identifying abnormal SQL statements according to the present invention. Detailed Implementation

[0046] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the protection scope of the present invention.

[0047] The present invention will be further described below with reference to specific embodiments.

[0048] Example 1:

[0049] This embodiment introduces an intelligent detection method for identifying abnormal SQL statements, such as... Figure 1 As shown, it specifically includes:

[0050] Step 1: Perform deep preprocessing on the original SQL statement to obtain a vector sequence that integrates semantics and structure.

[0051] Step 2: Input the vector sequence that integrates semantics and structure into the feature extraction network, and output local feature vectors, global feature vectors, and deep fusion feature vectors.

[0052] Step 3: Input the local feature vector into the first base learner to obtain the first SQL statement anomaly probability. Input the global feature vector into the second base learner to obtain the second SQL statement anomaly probability. Input the deep fusion feature vector into the third base learner to obtain the third SQL statement anomaly probability.

[0053] Step 4: Input the original SQL statement into the scene feature extractor to obtain a multidimensional feature vector, and input the multidimensional feature vector into the meta-learner to obtain dynamic weights.

[0054] Step 5: Weight and aggregate the anomaly probabilities of the first, second, and third SQL statements with dynamic weights to obtain the final anomaly probability. Compare the final anomaly probability with the threshold to obtain the final anomaly detection result.

[0055] Furthermore, step 1 specifically includes:

[0056] The original SQL statement is parsed to generate an abstract syntax tree.

[0057] Obtain the sub-word embedding paths from the abstract syntax tree, and generate semantic vectors by querying the embedding table based on the keywords in the sub-word embedding paths.

[0058] Obtain the syntax tree embedding path of the abstract syntax tree, aggregate upwards from the leaf nodes to the expression nodes, and generate a structure vector.

[0059] The semantic vector and the structural vector are aligned and merged according to the node positions of the abstract syntax tree to obtain a vector sequence that combines semantics and structure.

[0060] In this context, the abstract syntax tree (AST) represents the tree-structured representation of the source code, with each node corresponding to a syntax element (such as an expression or statement) in the program. In SQL parsing, the root node represents the complete query, child nodes correspond to clauses such as SELECT and WHERE, and leaf nodes are operands or identifiers used to precisely describe the hierarchical logic of the SQL.

[0061] Subword embedding path representation is a technique that splits words into smaller subunits (such as prefixes and suffixes) and vectorizes them. For example, UNION is broken down into UN-ION, enabling the model to recognize variant forms (such as UN / ** / ION) and enhancing robustness against obfuscation attacks.

[0062] Furthermore, in one embodiment, consider a statement that might contain injection attacks: "SELECT * FROM users WHERE id=1 OR 1=1; -- comment". First, syntax parsing is performed to generate an abstract syntax tree. The root node of this tree is SelectStatement, whose child nodes include Keywords (SELECT), Columns (*), FromClause, WhereClause, etc. WhereClause is further expanded into ConditionExpression, which contains multiple conditional child nodes. In the dual-path embedding process, the sub-word embedding path decomposes keywords such as "SELECT" into sub-word units such as ["SEL", "ECT"], generating a corresponding 128-dimensional semantic vector by querying the embedding table. The syntax tree embedding path then processes the data through a recursive neural network, for example, starting from the leaf nodes "id" and "1", aggregating upwards to the conditional expression nodes, ultimately generating a 128-dimensional structure vector. The outputs of the two paths are aligned according to the syntax tree node positions; for example, the semantic vector and structure vector corresponding to the WhereClause node are concatenated to generate a 256-dimensional hybrid vector. The final output is a complete sequence of vectors, with each syntax tree node corresponding to a vector representation that integrates semantic and structural information.

[0063] Furthermore, the feature extraction network includes: a convolutional neural network channel, a bidirectional long short-term memory network channel, and a cross-modal attention fusion layer.

[0064] In this process, a vector sequence that integrates semantics and structure is input into the convolutional neural network channel to obtain local feature vectors.

[0065] A vector sequence that integrates semantics and structure is input into a bidirectional long short-term memory network channel to obtain a global feature vector.

[0066] The local and global feature vectors are input into the cross-modal attention fusion layer to obtain a deep fused feature vector.

[0067] Furthermore, in one embodiment, assuming the input vector sequence fusing semantics and structure has a length of N, and each vector has a dimension of 256, it can be represented as a matrix of [N, 256]. In a convolutional neural network (CNN), convolutional kernels with widths of 3, 5, and 7 are used for scanning. For example, a convolutional kernel with a width of 3 can capture local patterns such as "OR 1=1", generating high activation values ​​at specific locations in the sequence. Each convolutional kernel generates a corresponding feature map, which, after passing through a max-pooling layer, extracts the most salient local features, ultimately generating a set of local feature vectors.

[0068] In Bidirectional Long Short-Term Memory (Bi-LSTM) networks, vector sequences are processed from front to back and from back to front, respectively, which can identify the truncation effect of the annotation symbol "--" on subsequent semantics and generate global feature vectors containing complete contextual information.

[0069] The outputs from both channels enter a cross-modal attention fusion layer, where the feature fusion ratio is dynamically adjusted by calculating cross-attention weights. For example, when processing complex nested queries, the system assigns higher weights to the global features generated by the Bi-LSTM, while when processing simple conditional expressions, it focuses more on the local features extracted by the CNN, outputting a deep fused feature vector.

[0070] Furthermore, the first base learner includes a fully connected network. This fully connected network includes multiple hidden layers that undergo a non-linear transformation using the deep learning activation function ReLU.

[0071] The second base learner includes a support vector machine.

[0072] The third base learner includes a random forest classifier.

[0073] Furthermore, in one embodiment, it is assumed that the local feature vector dimension is 100 dimensions, the global feature vector dimension is 128 dimensions, and the deep fusion feature vector dimension is 200 dimensions.

[0074] The first base learner receives local feature vectors and processes them through a fully connected network. The network contains multiple hidden layers and uses the ReLU activation function for non-linear transformation. For example, when the input features contain typical injection patterns like "OR 1=1", the network will produce a high anomaly probability in the output layer, such as 0.85.

[0075] The second base learner receives the global feature vector and uses a support vector machine (SVM) for classification. The SVM searches for the optimal separating hyperplane in the high-dimensional feature space. When the input global features exhibit abnormal contextual patterns, such as semantic incoherence caused by the abnormal use of annotations, the SVM outputs the corresponding anomalous probability.

[0076] The third base learner receives deeply fused features and makes decisions using a random forest. The random forest contains multiple decision trees, each making judgments based on a different subset of features, and finally generating anomaly probabilities through a voting mechanism.

[0077] The three base learners use differentiated training data, such as obtaining different training subsets through bootstrap sampling, to ensure that complementary anomalous patterns are learned. The final output consists of three independent anomalous probability values, P1, P2, and P3.

[0078] Furthermore, the multidimensional feature vector includes, but is not limited to: statement length, subquery depth, and keyword distribution.

[0079] Furthermore, the meta-learner includes a multilayer perceptron, wherein the multilayer perceptron contains multiple hidden layers and uses deep learning activation functions sigmoid or tanh.

[0080] Furthermore, in one embodiment, the scene feature extractor extracts multidimensional features from the original SQL statement, such as: statement length (e.g., 25 tokens), subquery depth (e.g., 0 levels), keyword distribution (e.g., SELECT appears once, WHERE appears once), etc. These features are organized into multidimensional feature vectors and input into the meta-learner.

[0081] The meta-learner is a multilayer perceptron containing multiple hidden layers, using deep learning activation functions such as sigmoid or tanh. It learns the complex mapping between scene features and the performance of base learners. For example, when a large subquery depth is detected, the meta-learner will assign higher weights to the Bi-LSTM base learner (e.g., W2=0.6); when the statement is short, it will assign higher weights to the CNN base learner (e.g., W1=0.5).

[0082] Furthermore, the expression for the final anomaly probability P_final is as follows:

[0083] P_final = W1×P1 + W2×P2 + W3×P3

[0084] Where W1 is the local dynamic weight, W2 is the global dynamic weight, W3 is the deep dynamic weight, P1 is the probability of an anomaly in the first SQL statement, P2 is the probability of an anomaly in the second SQL statement, and P3 is the probability of an anomaly in the third SQL statement.

[0085] Furthermore, in one embodiment, assuming the input probability values ​​are [0.8, 0.3, 0.6] and the weights are [0.4, 0.3, 0.3], then P_final = 0.8×0.4 + 0.3×0.3 + 0.6×0.3 = 0.59. This value is then thresholded (e.g., a threshold of 0.5) to output the final anomaly detection result. The entire process achieves adaptive decision-making based on scene features, significantly improving detection accuracy.

[0086] Example 2:

[0087] This embodiment describes the working principle of an intelligent detection method for identifying abnormal SQL statements, specifically including:

[0088] The system receives raw SQL statement input and performs syntax parsing and feature encoding through a deep preprocessing module. This module employs a deep parsing method based on abstract syntax trees (ASTs) to transform the SQL statement into a structured computational representation. AST nodes precisely correspond to SQL syntax elements, including key information such as query type, conditional expressions, table names, and column names. Sub-word embedding vectors are generated based on AST nodes, and byte-pair encoding is used to decompose SQL keywords into sub-word units, effectively capturing semantic variation features of keywords and overcoming the detection blind spots caused by lexical variations in traditional methods. Simultaneously, a recurrent neural network transforms the syntax tree structure into hierarchical vectors. The recurrent neural network aggregates information along the syntax tree hierarchy, with features from lower-level nodes being passed upwards and continuously fused, ultimately forming a deep representation of SQL nesting relationships. The two embedding outputs are aligned and concatenated according to node positions to form a hybrid vector sequence that simultaneously carries semantic and structural information, laying a solid foundation for subsequent feature extraction.

[0089] The feature extraction module employs a dual-channel design to simultaneously process mixed vector sequences, fully leveraging the advantages of different neural network architectures. The convolutional neural network channel uses multi-scale convolutional kernels to scan the vector sequence; different kernel sizes capture short-range grammatical patterns and medium-range dependencies, focusing on extracting local grammatical aberrations, such as illegal conditional expressions and combinations of aberrant operators. The bidirectional long short-term memory network channel models the overall contextual dependencies of the statement in both forward and backward directions, selectively memorizing and forgetting information through a gating mechanism, effectively capturing long-range semantic associations and logical constraints. The outputs of both channels enter a cross-modal attention fusion layer. This layer dynamically evaluates the importance ratio of local grammatical features to global semantic features through a cross-attention weighting mechanism. Cross-attention is implemented through a query-key-value matching mechanism, where the query comes from the feature representation of one modality, and the key comes from the feature representation of another modality. Attention weights are obtained by calculating the similarity between the query and the key. For complex structures such as nested queries, the system automatically increases the contribution weight of global semantic features, making the model more focused on long-range dependencies, achieving deep feature interaction, and completely overcoming the shortcomings of insufficient feature interaction in traditional concatenation and fusion methods.

[0090] The heterogeneous base learner cluster comprises three independently operating detection units, each optimized for a specific type of feature pattern. The first detection unit takes local features extracted by a convolutional neural network as input, performs classification decisions through a fully connected network, and uses multi-layer nonlinear transformations to progressively abstract feature representations, ultimately outputting anomaly probabilities. The second detection unit inputs global features extracted by a bidirectional long short-term memory network into a support vector machine classifier. The support vector machine achieves classification by finding the maximum margin hyperplane, demonstrating excellent generalization ability for high-dimensional features. The third detection unit trains a random forest model using fused features output from an attention fusion layer. The random forest effectively reduces the risk of overfitting by integrating the prediction results of multiple decision trees. Each base learner uses a differentiated training dataset, constructing independent data distributions through a self-sampling strategy. Self-sampling employs random sampling with replacement to ensure that each base learner's training set has unique sample composition and distribution characteristics, guaranteeing model diversity from the source and preventing similar prediction biases among base learners.

[0091] The dynamic weighted decision module enables adaptive scenario judgment, dynamically adjusting decision strategies based on the structural characteristics of different SQL statements. This module extracts multi-dimensional scenario features from the original SQL statements, including structural attributes such as statement length, subquery depth, and keyword type distribution. Statement length is obtained by counting the number of tokens in the SQL statement; subquery depth is calculated by analyzing the hierarchical structure of the syntax tree; and keyword type distribution is obtained by counting the frequency of occurrence of different keyword categories. These scenario features are input into a meta-learner constructed from a multilayer perceptron (MLP). The MLP contains multiple hidden layers and learns the complex mapping relationship between scenario features and the performance of base learners through a non-linear activation function. The meta-learner dynamically generates weight coefficients for each base learner based on scenario features. The weight generation process is based on learning from historical performance data, allowing base learners that perform well in specific scenarios to receive higher weights. In nested query scenarios, the decision weights of the global feature model are automatically enhanced because bidirectional long short-term memory networks are better able to capture deeply nested logical relationships; in short-statement scenarios, the influence of the local feature model is increased because convolutional neural networks are more sensitive to local abnormal patterns in short texts. The final anomaly probability is generated through weighted aggregation, which uses a linear combination approach. The output probability of each base learner is multiplied by its corresponding weight coefficient and then summed to obtain a comprehensive anomaly probability estimate. The final output is then thresholded, with the threshold set according to the balance between false positive and false negative rates, thus completing the task of detecting abnormal SQL statements.

[0092] To address the bottleneck in complex structure recognition, a cross-modal attention mechanism achieves deep interaction between local syntax and global semantics through dynamic feature weighting, significantly improving the parsing capability of nested queries. To address scenario adaptability issues, a meta-learner-driven dynamic weighting strategy automatically adjusts the base model decision weights based on SQL structure characteristics, ensuring optimal judgment in different scenarios. To overcome diversity limitations, multi-scale embedding encoding and independent training set construction provide dual protection, enhancing model complementarity at the feature space and data distribution levels. The collaborative operation of all modules forms a complete technical closed loop from feature learning to decision optimization, achieving a substantial improvement in detection efficiency while ensuring feasibility for implementation.

[0093] It mainly consists of a multi-scale embedding preprocessing mechanism, a cross-modal dynamic attention fusion layer, and a meta-learning-driven scene adaptive decision framework.

[0094] (1) Multi-scale embedding preprocessing mechanism. This technique is based on abstract syntax trees to achieve parallel encoding. Specifically, the sub-word embedding path captures the semantic variant features of keywords, and the syntax tree embedding path transforms the nested structure into a hierarchical vector through a recurrent neural network. The output is fused according to node alignment to generate a hybrid feature sequence that carries both syntactic and semantic information. This design solves the defect of structural feature loss in traditional methods.

[0095] (2) Cross-modal dynamic attention fusion layer. This layer dynamically weights the local syntactic features of a convolutional neural network and the global semantic features of a bidirectional long short-term memory network through a cross-attention mechanism. It automatically enhances the weights of global features for nested query scenarios, enabling deep interaction between local abnormal fragments and long-range logical dependencies. This technology fundamentally overcomes the mechanical defects of existing feature splicing and fusion methods.

[0096] (3) Meta-learning-driven scenario-adaptive decision-making framework. By analyzing scenario features such as subquery depth and keyword distribution of the original SQL, dynamic weight coefficients of the base learner are generated using a multilayer perceptron. During the detection process, the weights of the dominant model are automatically adjusted according to the characteristics of the statement structure, establishing a precise matching mechanism between scenario requirements and model advantages. This innovation completely replaces the static voting strategy of traditional ensemble learning.

[0097] Example 3:

[0098] This embodiment introduces an intelligent detection device for identifying abnormal SQL statements, specifically including:

[0099] Deep preprocessing module: Used to perform deep preprocessing on the original SQL statement to obtain a vector sequence that integrates semantics and structure.

[0100] Feature extraction module: This module takes a sequence of vectors that fuse semantics and structure as input to the feature extraction network and outputs local feature vectors, global feature vectors, and deeply fused feature vectors.

[0101] The heterogeneous base learner cluster module is used to input local feature vectors into the first base learner to obtain the first SQL statement anomaly probability. It then inputs the global feature vectors into the second base learner to obtain the second SQL statement anomaly probability. Finally, it inputs the deep fusion feature vectors into the third base learner to obtain the third SQL statement anomaly probability.

[0102] Dynamic weight module: Used to input the original SQL statement into the scene feature extractor to obtain a multi-dimensional feature vector, and input the multi-dimensional feature vector into the meta-learner to obtain dynamic weights.

[0103] Weighted decision module: It is used to weight and aggregate the anomaly probabilities of the first SQL statement, the second SQL statement, and the third SQL statement with dynamic weights to obtain the final anomaly probability. The final anomaly probability is then compared with a threshold to obtain the final anomaly detection result.

[0104] Example 4:

[0105] This embodiment describes a computer-readable storage medium storing a computer program that, when executed by a processor, implements an intelligent detection method for determining abnormal SQL statements as described in any of Embodiment 1.

[0106] Example 5:

[0107] This embodiment describes a computer device, including:

[0108] Memory is used to store instructions.

[0109] A processor is configured to execute the instructions, causing the computer device to perform operations of an intelligent detection method for determining abnormal SQL statements as described in any of Embodiment 1.

[0110] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0111] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0112] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0113] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0114] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. An intelligent detection method for identifying abnormal SQL statements, characterized in that: Specifically, it includes: The original SQL statement is deeply preprocessed to obtain a vector sequence that integrates semantics and structure; Input a vector sequence that integrates semantics and structure into a feature extraction network, and output local feature vectors, global feature vectors, and deeply fused feature vectors. The local feature vector is input into the first base learner to obtain the first SQL statement anomaly probability; the global feature vector is input into the second base learner to obtain the second SQL statement anomaly probability; the deep fusion feature vector is input into the third base learner to obtain the third SQL statement anomaly probability. The original SQL statement is input into the scene feature extractor to obtain a multidimensional feature vector, and the multidimensional feature vector is input into the meta-learner to obtain dynamic weights. The anomaly probabilities of the first, second, and third SQL statements are weighted and aggregated with dynamic weights to obtain the final anomaly probability. The final anomaly probability is then compared with a threshold to obtain the final anomaly detection result.

2. The intelligent detection method for judging abnormal SQL statements according to claim 1, characterized in that: Step 1 specifically includes: The original SQL statement is parsed to generate an abstract syntax tree; Obtain the sub-word embedding paths from the abstract syntax tree, and generate semantic vectors by querying the embedding table based on the keywords in the sub-word embedding paths; Obtain the syntax tree embedding path of the abstract syntax tree, aggregate upwards from the leaf nodes to the expression nodes, and generate a structure vector; The semantic vector and the structural vector are aligned and merged according to the node positions of the abstract syntax tree to obtain a vector sequence that combines semantics and structure.

3. The intelligent detection method for judging abnormal SQL statements according to claim 1, characterized in that: The feature extraction network includes: a convolutional neural network channel, a bidirectional long short-term memory network channel, and a cross-modal attention fusion layer; In this process, a vector sequence that integrates semantics and structure is input into the convolutional neural network channel to obtain local feature vectors; A vector sequence that integrates semantics and structure is input into a bidirectional long short-term memory network channel to obtain a global feature vector. The local and global feature vectors are input into the cross-modal attention fusion layer to obtain a deep fused feature vector.

4. The intelligent detection method for judging abnormal SQL statements according to claim 1, characterized in that: The first base learner includes a fully connected network; the second base learner includes a support vector machine; and the third base learner includes a random forest classifier.

5. The intelligent detection method for judging abnormal SQL statements according to claim 1, characterized in that: The multidimensional feature vector includes, but is not limited to: statement length, subquery depth, and keyword distribution.

6. The intelligent detection method for judging abnormal SQL statements according to claim 1, characterized in that: The meta-learner includes a multilayer perceptron.

7. The intelligent detection method for judging abnormal SQL statements according to claim 1, characterized in that: The expression for the final anomaly probability P_final is as follows: P_final = W1×P1 + W2×P2 + W3×P3; Where W1 is the local dynamic weight, W2 is the global dynamic weight, W3 is the deep dynamic weight, P1 is the probability of an anomaly in the first SQL statement, P2 is the probability of an anomaly in the second SQL statement, and P3 is the probability of an anomaly in the third SQL statement.

8. An intelligent detection device for identifying abnormal SQL statements, characterized in that: Specifically, it includes: Deep preprocessing module: used to perform deep preprocessing on the original SQL statement to obtain a vector sequence that integrates semantics and structure; Feature extraction module: This module takes a sequence of vectors that fuse semantics and structure as input to the feature extraction network and outputs local feature vectors, global feature vectors, and deeply fused feature vectors. Heterogeneous base learner cluster module: used to input local feature vectors into the first base learner to obtain the first SQL statement anomaly probability; input global feature vectors into the second base learner to obtain the second SQL statement anomaly probability; input deep fusion feature vectors into the third base learner to obtain the third SQL statement anomaly probability; The dynamic weight module is used to input the original SQL statement into the scene feature extractor to obtain a multi-dimensional feature vector, and then input the multi-dimensional feature vector into the meta-learner to obtain dynamic weights. Weighted decision module: It is used to weight and aggregate the anomaly probabilities of the first SQL statement, the second SQL statement, and the third SQL statement with dynamic weights to obtain the final anomaly probability. The final anomaly probability is then compared with a threshold to obtain the final anomaly detection result.

9. A computer-readable storage medium, characterized in that: It stores a computer program that, when executed by a processor, implements an intelligent detection method for determining abnormal SQL statements as described in any one of claims 1 to 7.

10. A computer device, characterized in that: include: Memory, used to store instructions; A processor is configured to execute the instructions, causing the computer device to perform the operation of an intelligent detection method for determining abnormal SQL statements as described in any one of claims 1 to 7.

Images