A SQL injection attack detection method, device, equipment and storage medium

Abstract

This invention discloses a method, apparatus, device, and storage medium for detecting SQL injection attacks. The method includes the following steps: based on an abstract syntax tree generated by parsing a received SQL statement, semantically and syntactically encoding the nodes in the abstract syntax tree to obtain semantic feature vectors and syntactic feature vectors for each node; concatenating and fusing the semantic feature vectors and syntactic feature vectors to generate initial features for each node; based on a constructed sparse heterogeneous graph, using a graph convolutional network to propagate the initial features between each node and its neighboring nodes to obtain updated features for each node; performing global average pooling on the updated features of the nodes to obtain a global representation vector of the SQL statement, and inputting the global representation vector into a classifier to output the SQL injection detection result. This application can significantly reduce the computational resource requirements of the model while maintaining high detection accuracy.

Description

Technical Field

[0001] This invention relates to the field of electronic digital data processing technology, and in particular to a method, apparatus, device, and storage medium for detecting SQL injection attacks. Background Technology

[0002] With the widespread use of web applications, SQL injection attacks remain one of the most significant threats to cybersecurity. Attackers construct malicious SQL statement fragments at application input points, tampering with the original query logic of the backend database, leading to serious security incidents such as data breaches, privilege escalation, or data corruption.

[0003] Traditional Web Application Firewalls (WAFs) use regular expressions to match special characters in SQL statements (such as 'OR1=1 --', 'union select', etc.) or classify SQL statements based on statistical features after parsing the SQL syntax (such as AST depth, number of nodes, keyword frequency) using random forests or XGBoost. These methods are effective against known attack patterns, but they have the following shortcomings: 1. They are difficult to detect SQL injection statements that have undergone obfuscation, encoding transformation, or semantic adversarial processing; 2. Feature engineering relies on human experience and has limited generalization ability.

[0004] Existing research parses SQL into an Abstract Syntax Tree (AST) and then uses Graph Convolutional Networks (GCNs) or Graph Attention Networks (GATs) to learn features from the AST nodes. This approach suffers from the following problems: 1. Large model parameter count (typically exceeding 2 million), relying on GPUs for training and inference, making deployment on general-purpose servers difficult; 2. Insufficient utilization of semantic information, mostly using only syntactic structure and ignoring the semantic features of SQL statements; 3. Lack of caching mechanisms, repeatedly performing graph construction and inference on SQL statements with different parameters under the same AST template, resulting in significant waste of computational resources.

[0005] Therefore, how to significantly reduce the computational resource requirements of the model while maintaining a high detection accuracy and achieve real-time SQL injection detection on the CPU is a technical problem that urgently needs to be solved. Summary of the Invention

[0006] The main objective of this invention is to provide a method, apparatus, device, and storage medium for detecting SQL injection attacks, which can significantly reduce the computational resource requirements of the model while maintaining a high detection accuracy.

[0007] Firstly, this application provides a method for detecting SQL injection attacks, wherein the method includes the following steps: Based on the abstract syntax tree generated by parsing the received SQL statement, semantic and syntactic encodings are performed on the nodes in the abstract syntax tree to obtain the semantic feature vector and syntactic feature vector of each node. The semantic feature vector and the syntactic feature vector are concatenated and fused to generate the initial features of each node; Based on the constructed sparse heterogeneous graph, the graph convolutional network is used to propagate the initial features between each node and its neighboring nodes to obtain the updated features of each node. The update features of the node are subjected to global average pooling to obtain the global representation vector of the SQL statement. The global representation vector is then input into a classifier to output the injection detection result of the SQL statement.

[0008] In conjunction with the first aspect mentioned above, as an optional implementation method, each node of the abstract syntax tree is used as a graph node, and the parent-child edges and sibling edges in the abstract syntax tree are used as graph edges to construct a sparse heterogeneous graph. Based on the construction of a sparse heterogeneous graph, a fixed-layer graph convolutional network is used, and the neighbor aggregation range with a fixed number of hops set for each layer of the graph convolutional network is used to perform weighted average aggregation of the features of the neighbor nodes of each node, so that feature messages can be propagated between each node and its neighboring nodes to obtain the updated features of each node.

[0009] In conjunction with the first aspect mentioned above, as an optional implementation method, a pre-trained Word2Vec model is used to vectorize the keywords and literals in the abstract syntax tree nodes, and TF-IDF weighted combination with random initialization is used to vectorize the tokens that are not keywords or literals, so as to obtain the semantic feature vectors of each node. One-hot encoding is performed on the syntax type of the nodes in the abstract syntax tree to obtain the syntax feature vector of each node.

[0010] In conjunction with the first aspect mentioned above, as an optional implementation, the literals in the SQL statement are replaced with uniform placeholders to generate an abstract syntax tree template hash. Perform a hash calculation on the abstract syntax tree template to obtain the hash value of the abstract syntax tree template; The first-level cache is queried using the hash value of the abstract syntax tree template as an index; If the first-level cache is hit, the injection detection result pre-stored in the SQL statement is returned directly.

[0011] In conjunction with the first aspect mentioned above, as an optional implementation, if the first-level cache is not hit, the second-level cache is queried using the abstract syntax tree template hash and the ID of each node as indexes when obtaining the semantic feature vector of each node. If the second-level cache is hit, the semantic feature vector pre-stored by the node is directly retrieved; If the second-level cache is not hit, the semantic encoding step is performed, and the generated semantic vector is stored in the second-level cache.

[0012] In conjunction with the first aspect mentioned above, as an optional implementation method, the semantic feature vector and the syntactic feature vector are concatenated end to end to obtain a concatenated feature vector; The linear transformation layer is used to map the feature vectors to a unified dimension, and the initial features of each node are output, which integrate syntactic and semantic information.

[0013] In conjunction with the first aspect mentioned above, as an optional implementation method, global average pooling or max pooling is performed on the update features of all nodes globally to obtain a global representation vector at the SQL level. The global representation vector is input into a two-layer fully connected classifier to output the detection result of whether the SQL statement is normal or injected.

[0014] Secondly, this application provides an SQL injection attack detection device, which includes: The encoding module is used to perform semantic and syntactic encoding on the nodes in the abstract syntax tree generated by parsing the received SQL statement, so as to obtain the semantic feature vector and syntactic feature vector of each node. The concatenation module is used to concatenate and fuse the semantic feature vector and the grammatical feature vector to generate the initial features of each node; The processing module is used to propagate the initial features between each node and its neighboring nodes based on the constructed sparse heterogeneous graph using a graph convolutional network to obtain the updated features of each node. The verification module is used to perform global average pooling on the update features of the node to obtain the global representation vector of the SQL statement, and input the global representation vector into the classifier to output the injection detection result of the SQL statement.

[0015] Thirdly, this application also provides an electronic device, the electronic device comprising: a processor; and a memory storing computer-readable instructions, which, when executed by the processor, implement the method described in any one of the first aspects.

[0016] Fourthly, this application also provides a computer-readable storage medium storing computer program instructions that, when executed by a computer, cause the computer to perform the method described in any of the first aspects.

[0017] This application provides a method, apparatus, device, and storage medium for detecting SQL injection attacks. The method includes the following steps: based on an abstract syntax tree generated by parsing a received SQL statement, semantically and syntactically encoding the nodes in the abstract syntax tree to obtain semantic feature vectors and syntactic feature vectors for each node; concatenating and fusing the semantic feature vectors and syntactic feature vectors to generate initial features for each node; based on a constructed sparse heterogeneous graph, using a graph convolutional network to propagate the initial features between each node and its neighboring nodes to obtain updated features for each node; performing global average pooling on the updated features of the nodes to obtain a global representation vector of the SQL statement; and inputting the global representation vector into a classifier to output the SQL injection detection result. This application can significantly reduce the computational resource requirements of the model while maintaining high detection accuracy.

[0018] It should be understood that the above general description and the following detailed description are merely exemplary and do not limit the invention. Attached Figure Description

[0019] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0020] Figure 1 This is a flowchart of an SQL injection attack detection method provided in the embodiments of this application; Figure 2 This is a schematic diagram of an SQL injection attack detection device provided in an embodiment of this application; Figure 3 This is a schematic diagram of an electronic device provided in an embodiment of this application; Figure 4 This is a schematic diagram of a computer-readable program medium provided in an embodiment of this application. Detailed Implementation

[0021] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the invention as detailed in the appended claims.

[0022] Furthermore, the accompanying drawings are merely illustrative of this disclosure and are not necessarily drawn to scale. Some of the block diagrams shown in the drawings represent functional entities and do not necessarily correspond to physically or logically independent entities.

[0023] The embodiments of this application will be further described in detail below with reference to the accompanying drawings.

[0024] Reference Figure 1 , Figure 1 The diagram shown is a flowchart of an SQL injection attack detection method provided by the present invention. Figure 1 As shown, the method includes the following steps: Step S101: Based on the abstract syntax tree generated by parsing the received SQL statement, perform semantic encoding and syntax encoding on the nodes in the abstract syntax tree to obtain the semantic feature vector and syntax feature vector of each node.

[0025] Specifically, a pre-trained Word2Vec model is used to vectorize the keywords and literals in the abstract syntax tree nodes, and TF-IDF weighted combination with random initialization is used to vectorize the tokens that are not keywords or literals, so as to obtain the semantic feature vector of each node; the syntax type of the abstract syntax tree nodes is one-hot encoded to obtain the syntax feature vector of each node.

[0026] For ease of understanding and illustration, a pre-trained Word2Vec (128-dimensional) is used to vectorize keywords (such as SELECT, WHERE, UNION) and literals in the AST nodes; for uncommon tokens in SQL, TF-IDF weighting and random initialization are used to avoid vocabulary explosion; results: semantic extraction time is about 2-3ms, memory usage is about 200MB, and no GPU is required.

[0027] Specifically, a pre-trained Word2Vec (128-dimensional) model is used to vectorize keywords (such as SELECT, WHERE, UNION) and literals in the AST nodes. Understandably, firstly, for common, meaningful words in SQL statements, such as operation commands (SELECT, WHERE, UNION) and specific numbers or strings (such as 123, 'admin'), the system directly calls a pre-trained Word2Vec model. This model maps each word to a dense vector containing 128 values ​​(simply put, a 128-dimensional coordinate point), thus capturing the semantic information of the word. Secondly, to prevent the model vocabulary from becoming too large and causing memory explosion (e.g., random table names, garbled characters, or extremely long numerical values), the system does not create vectors for all rare words. Instead, it first uses the TF-IDF algorithm to evaluate the importance of the word in the entire SQL set, and then combines it with a randomly generated initial vector. In this way, rare words obtain vector representations without occupying excessive vocabulary space, achieving a balance between accuracy and resource consumption.

[0028] In one embodiment, before obtaining the semantic feature vector and syntactic feature vector of each node, the following steps are included: Replace the literals in the SQL statement with uniform placeholders to generate an abstract syntax tree template hash. Perform a hash calculation on the abstract syntax tree template to obtain the hash value of the abstract syntax tree template; The first-level cache is queried using the hash value of the abstract syntax tree template as an index; If the first-level cache is hit, the injection detection result pre-stored in the SQL statement is returned directly.

[0029] If the first-level cache is not hit, the second-level cache is queried using the abstract syntax tree template hash and the ID of each node as indexes when retrieving the semantic feature vector of each node. If the second-level cache is hit, the semantic feature vector pre-stored by the node is directly retrieved; If the second-level cache is not hit, the semantic encoding step is performed, and the generated semantic vector is stored in the second-level cache.

[0030] Understandably, this is an AST-aware second-level cache mechanism: First-level cache: AST template hash (MD5 or SHA-1), which calculates the hash after replacing literals (numbers, strings) in the SQL with placeholders. Upon a hit, the previously stored detection result is returned directly, with a latency of <0.5ms. It's important to explain the function of template hashing: to identify similar SQL statements. AST template hashing can be understood as parsing the SQL statement into an Abstract Syntax Tree (AST), uniformly replacing all literals that change with user input (such as the number 1, the string "admin") with fixed placeholders (such as ?), thus extracting the syntactic skeleton (i.e., the template) of the SQL statement, and then calculating the hash value (such as MD5 or SHA-1) on this template. For example, AST template hashing is the result of hashing a standardized template string after literal replacement (such as SELECT * FROM users WHERE id = ? AND name = ?).

[0031] In other words: Original SQL: SELECT * FROM users WHERE id = 123 AND name = 'User A'. Template string: SELECT * FROM users WHERE id = ? AND name = ?. AST template hash: MD5("SELECT * FROM users WHERE id = ? AND name = ?") or SHA-1 encoded result.

[0032] Second-level cache: Node semantic vectors (Word2Vec output), indexed by AST template hash + node ID. Upon a hit, the semantic encoding step is skipped, saving approximately 2-3ms.

[0033] The cache eviction policy of this method is LRU (Least Recently Used), and the capacity limit is set to 2000 templates; attention weights are not cached for the time being (because GCN does not have attention), thus reducing the complexity of cache management.

[0034] To illustrate, when the system receives an SQL statement, it first replaces the specific numerical values ​​or strings (such as the numbers 123 or the text 'admin') with uniform placeholders (such as '?'), thereby extracting an abstract syntax tree template that retains only the structural skeleton, and then calculates the unique hash value of this template. The system uses this hash value as an index to query the first-level cache: if a match is found, it means that the SQL with the exact same structure has been processed before, and the previous detection result is returned directly, with the entire process taking very little time (less than 0.5 milliseconds). If a match is not found, the system needs to further calculate the semantic feature vectors of each node in the SQL. When calculating the vector of each node, the system uses the template hash value + node ID as a combination key to query the second-level cache: if a match is found, it means that the semantic vector of this node has already been calculated when processing other SQL statements (such as the same WHERE keyword in different SQL statements), and it is directly reused, skipping the vectorization process which takes about 2-3 milliseconds; if a match is not found, the actual semantic encoding calculation is performed, and the calculated vector is stored in the second-level cache for subsequent reuse. This minimizes redundant calculations and significantly improves detection efficiency.

[0035] Step S102: Concatenate and fuse the semantic feature vector and the grammatical feature vector to generate the initial features of each node.

[0036] Specifically, the semantic feature vector and the grammatical feature vector are concatenated end to end to obtain a concatenated feature vector; a linear transformation layer is used to map the concatenated feature vector to a unified dimension, and the initial features of each node that integrates grammatical and semantic information are output.

[0037] For ease of understanding, the syntax type of the AST node (such as "Select", "Where", "Comparison") is one-hot encoded (dimension ≤ 30); the one-hot syntax vector is concatenated with the Word2Vec semantic vector to form the initial node features (total dimension ≤ 158); a learnable linear transformation layer is used to map the concatenated features to a unified dimension (128 dimensions).

[0038] Understandably, for each node in the AST (such as a "Select" node representing a query operation, or a "Comparison" node representing a conditional judgment), the system converts its syntax type into a one-hot encoded vector. The vector length does not exceed 30 dimensions. Simultaneously, the Word2Vec semantic vector (128 dimensions) generated in the previous step is used to represent the specific lexical meaning contained in the node (e.g., the semantics of the word "SELECT" itself). Next, the system directly concatenates these two vectors end-to-end, forming a new concatenated vector with a total dimension not exceeding 158 dimensions. However, since the length of the concatenated original semantic vector (128 dimensions) and syntax vector (≤30 dimensions) is not fixed and the feature space is not uniform, a learnable linear transformation layer (which can be understood as a small neural network layer) is finally introduced. This layer compresses or maps this concatenated vector into a unified 128-dimensional vector through matrix multiplication, serving as the final initial feature of the node for subsequent use by the graph neural network.

[0039] Step S103: Based on the constructed sparse heterogeneous graph, the initial features of each node and its neighboring nodes are propagated using a graph convolutional network to obtain the updated features of each node.

[0040] Specifically, a sparse heterogeneous graph is constructed by using each node of the abstract syntax tree as a graph node and the parent-child and sibling edges in the abstract syntax tree as graph edges. Based on the construction of a sparse heterogeneous graph, a fixed-layer graph convolutional network is used, and the neighbor aggregation range with a fixed number of hops set for each layer of the graph convolutional network is used to perform weighted average aggregation of the features of the neighbor nodes of each node, so that feature messages can be propagated between each node and its neighboring nodes to obtain the updated features of each node.

[0041] Understandably, a sparse heterogeneous graph is constructed using parent-child and sibling edges of the AST; a two-layer graph convolutional network is used, with each layer performing a weighted average aggregation of neighbor node features (no attention calculation required); a fixed 2-hop neighbor range (K=2) is set, because the AST depth of SQL is usually ≤6, and 2 hops can cover most semantic dependencies; a sparse adjacency matrix is ​​used for storage (when the number of nodes N=200, the storage complexity is O(N·d_avg) instead of O(N²)); after aggregation, ReLU activation and Dropout=0.3 are used to prevent overfitting.

[0042] To illustrate this more clearly, the system first reconstructs the AST into a heterogeneous graph with sparse connections between nodes, building upon the existing parent-child relationships and adding sibling relationships between nodes at the same level. This is achieved by storing only existing connections in a sparse adjacency matrix (e.g., storing approximately 600 edges for 200 nodes instead of 40,000). Next, the system employs a lightweight two-layer graph convolutional network (GCN) for feature propagation: in each layer, each node simply performs a weighted average of the features of all its neighbors (without calculating complex attention weights to save computational resources), then combines the aggregated information with its own features to update its representation. To capture sufficient semantic information while controlling computational costs, the system limits the propagation range to a fixed two hops (i.e., each node can see at most its neighbors' neighbors), because the depth of an SQL syntax tree typically does not exceed six layers, and key relationships (such as the same field in a SELECT clause and a WHERE clause) are mostly within two hops. After each aggregation, the system uses the ReLU activation function to zero out negative numbers to introduce non-linearity, and employs Dropout=0.3 (i.e., randomly ignoring 30% of neurons) to prevent overfitting. This design makes the information propagation process efficient and lightweight, and can run without a GPU.

[0043] Step S104: Perform global average pooling on the update features of the node to obtain the global representation vector of the SQL statement, and input the global representation vector into the classifier to output the injection detection result of the SQL statement.

[0044] Specifically, global average pooling or max pooling is performed on the update features of all nodes to obtain a global representation vector at the SQL level; the global representation vector is then input into a two-layer fully connected classifier to output the detection result of whether the SQL statement is normal or injected.

[0045] Understandably, global average pooling (or max pooling) is applied to all node features to obtain an SQL-level representation vector. This vector is then input into a two-layer fully connected classifier (64-dimensional hidden layers) and outputs a binary classification result (injection / normal). It's important to explain that the global representation vector is created by globally average pooling or max pooling all node features, compressing a variable-length node sequence into a fixed-length SQL-level representation vector (128 dimensions; a vector transforms an SQL statement into a list of numbers representing its meaning). In other words, the global representation vector is a single, fixed-dimensional vector extracted by global pooling, which aggregates the features of all nodes in the AST graph (features that have undergone semantic encoding, syntactic fusion, and contextual information interaction through 2-hop graph convolution, including both the literal meaning of the node and its structural role and neighbor logic within the tree). It highly condenses the complete syntactic topology and deep semantic logic of the entire SQL statement, essentially generating a unique high-dimensional digital identity for the SQL. The classifier only needs to read this identity to determine whether it is a malicious injection.

[0046] To illustrate this, after the graph convolutional network update, each AST node possesses a feature vector that integrates its own information with the structural information of its neighbors. Then, through global average pooling (or max pooling), the feature vectors of all nodes are compressed into a fixed-length SQL-level representation vector. This step is equivalent to summarizing the scattered local information across the entire syntax tree into a fingerprint that represents the overall semantics of the SQL statement. Finally, this summarized vector is fed into a very lightweight two-layer fully connected classifier, with the hidden layer dimension set to 64. Features are progressively refined through layer-by-layer linear transformations and non-linear activations, ultimately outputting a binary classification result (e.g., 0 for normal SQL, 1 for SQL injection attack), thus completing the security assessment of the input SQL statement.

[0047] It should be noted that this solution is implemented based on the following architecture: Training phase: The lightweight GCN model was trained offline on the HP R730.

[0048] Inference phase: Deploy Flask API service and integrate second-level cache.

[0049] During the load testing phase, multiple PCs simulated concurrent requests using JMeter.

[0050] In summary, the beneficial effects of this application include: Lightweight: The number of model parameters is ≤300,000, which is about 1 / 4 of that of a regular GCN, and all modules can be run on a CPU; High accuracy: 91.2% (5-fold cross-validation, 5000 test data points), outperforming random forest by 4.7%; Low latency: Average latency of 20-35ms when the cache is missed (depending on SQL complexity), and ≤2ms when the first-level cache is hit; Caching performance: In actual business scenarios, the cache hit rate is approximately 40-70%, and the overall average latency is approximately 10-18ms; Low-cost deployment: No GPU required, can be deployed on general-purpose x86 servers such as HP R730 and Dell PowerEdge.

[0051] In one embodiment, Phase 0: Offline pre-training: Collect SQL corpus (normal samples + injected samples) → Train Word2Vec model and output 128-dimensional word vectors → Statistical analysis of token frequencies and calculation of TF-IDF weights → Construct vocabulary and weight files for online loading.

[0052] Phase 1: First-level cache lookup (template-level cache): Input SQL statement → Parse and generate AST → Traverse AST, replacing all literals (numbers, strings, booleans, NULL, etc.) with placeholders "?" → Generate SQL template → Calculate MD5 hash value → Query first-level cache with hash value as key.

[0053] Hit: Directly return the historical detection results (delay <0.5ms), and the process ends.

[0054] Miss: Proceed to Phase 2.

[0055] Phase 2: Second-level cache lookup (node-level cache) For each node in the AST, generate a composite key (format: template hash + node ID), and use this composite key to query the second-level cache.

[0056] Hit: Directly retrieve the 128-dimensional semantic vector pre-stored for this node, skipping stage 3.

[0057] Miss: Proceed to Phase 3 for real-time calculation.

[0058] Phase 3: Semantic Encoding (Token Vectorization): Extract node token text → Determine token type: Common Tokens (SQL keywords or high-frequency literals): Query the pre-trained Word2Vec model to output a 128-dimensional semantic vector.

[0059] Rare Tokens (low-frequency identifiers, random strings, etc.): Obtain the TF-IDF weight of the token, multiply it by a randomly initialized 128-dimensional normal distribution vector, and output a weighted 128-dimensional semantic vector.

[0060] After the calculation is completed, the 128-dimensional semantic vector is asynchronously written back to the second-level cache for reuse by subsequent identical nodes.

[0061] Phase 4: Feature Fusion (Multimodal Stitching): Extract the node's syntax type (e.g., Select, Where, Comparison, Literal, etc.) → Perform one-hot encoding with a dimension not exceeding 30 → Concatenate the syntax vector with the 128-dimensional semantic vector output from stage 3 → Obtain a fusion vector with a dimension not exceeding 158 → Map it to a unified 128-dimensional space through a learnable linear transformation layer → Output the node's initial features.

[0062] Phase 5: GCN Propagation and Classification Output: 5.1 Constructing a sparse heterogeneous graph: Establish parent-child edges (bidirectional) based on parent-child relationships in the AST, establish sibling edges (bidirectional) based on sibling relationships, and add self-loops to each node.

[0063] 5.2 First-layer GCN propagation: Each node aggregates the features of its direct neighbors (1-hop range), calculates the weighted average, updates its own features → applies the ReLU activation function (sets negative values ​​to 0) → applies Dropout (randomly discards 30% of node features to prevent overfitting).

[0064] 5.3 Second-layer GCN propagation: Each node again aggregates the features of its direct neighbors (at this time, the neighbors already contain the information of their own neighbors, which is equivalent to indirectly aggregating the original node features within a 2-hop range) → calculates the weighted average → applies ReLU activation → applies Dropout (30%) → outputs the final node features.

[0065] 5.4 Global Pooling: Perform global average pooling or max pooling on the final features of all nodes to compress the variable-length node sequence into a fixed-length SQL-level representation vector (128 dimensions).

[0066] 5.5 Classification Output: Input the SQL-level vector into a two-layer fully connected classifier (128-dimensional → 64-dimensional → 2-dimensional) → Softmax outputs the injection probability and normal probability → The one with the higher probability is the detection result.

[0067] 5.6 Update Cache: Write the detection result back to the first-level cache (Key: template hash) → End of process, output detection result.

[0068] Reference Figure 2 , Figure 2 The diagram shown is a schematic of an SQL injection attack detection device provided by the present invention. Figure 2 As shown, the device includes: The encoding module 201 is used to perform semantic and syntactic encoding on the nodes in the abstract syntax tree generated by parsing the received SQL statement, so as to obtain the semantic feature vector and syntactic feature vector of each node. The splicing module 202 is used to splice and fuse the semantic feature vector and the grammatical feature vector to generate the initial features of each node; Processing module 203 is used to propagate the initial features between each node and its neighboring nodes based on the constructed sparse heterogeneous graph using a graph convolutional network to obtain the updated features of each node. The verification module 204 is used to perform global average pooling on the update features of the node to obtain the global representation vector of the SQL statement, and input the global representation vector into the classifier to output the injection detection result of the SQL statement.

[0069] Furthermore, in one possible implementation, the processing module is also used to construct a sparse heterogeneous graph by using each node of the abstract syntax tree as a graph node and the parent-child edges and sibling edges in the abstract syntax tree as graph edges. Based on the construction of a sparse heterogeneous graph, a fixed-layer graph convolutional network is used, and the neighbor aggregation range with a fixed number of hops set for each layer of the graph convolutional network is used to perform weighted average aggregation of the features of the neighbor nodes of each node, so that feature messages can be propagated between each node and its neighboring nodes to obtain the updated features of each node.

[0070] Furthermore, in one possible implementation, the encoding module is also used to vectorize the keywords and literals in the abstract syntax tree nodes using a pre-trained Word2Vec model, and to vectorize the tokens that are not keywords or literals using a TF-IDF weighted combination with random initialization, so as to obtain the semantic feature vector of each node. One-hot encoding is performed on the syntax type of the nodes in the abstract syntax tree to obtain the syntax feature vector of each node.

[0071] Furthermore, in one possible implementation, the processing module is also used to replace the literals in the SQL statement with uniform placeholders to generate an abstract syntax tree template hash. Perform a hash calculation on the abstract syntax tree template to obtain the hash value of the abstract syntax tree template; The first-level cache is queried using the hash value of the abstract syntax tree template as an index; If the first-level cache is hit, the injection detection result pre-stored in the SQL statement is returned directly.

[0072] Furthermore, in one possible implementation, the processing module is also configured to query the second-level cache using the abstract syntax tree template hash and the ID of each node as indexes when obtaining the semantic feature vector of each node if the first-level cache is not hit. If the second-level cache is hit, the semantic feature vector pre-stored by the node is directly retrieved; If the second-level cache is not hit, the semantic encoding step is performed, and the generated semantic vector is stored in the second-level cache.

[0073] Furthermore, in one possible implementation, the splicing module is also used to splice the semantic feature vector and the grammatical feature vector end to end to obtain a spliced ​​feature vector; The linear transformation layer is used to map the feature vectors to a unified dimension, and the initial features of each node are output, which integrate syntactic and semantic information.

[0074] Furthermore, in one possible implementation, the detection module is also used to perform global average pooling or max pooling on the update features of all nodes globally to obtain a global representation vector at the SQL level. The global representation vector is input into a two-layer fully connected classifier to output the detection result of whether the SQL statement is normal or injected.

[0075] The following reference Figure 3 To describe an electronic device 300 according to this embodiment of the present invention. Figure 3 The electronic device 300 shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.

[0076] like Figure 3 As shown, the electronic device 300 is presented in the form of a general-purpose computing device. The components of the electronic device 300 may include, but are not limited to: at least one processing unit 310, at least one storage unit 320, and a bus 330 connecting different system components (including storage unit 320 and processing unit 310).

[0077] The storage unit stores program code that can be executed by the processing unit 310, causing the processing unit 310 to perform the steps described in the "Embodiment Methods" section of this specification according to various exemplary embodiments of the present invention.

[0078] Storage unit 320 may include readable media in the form of volatile storage units, such as random access memory (RAM) 321 and / or cache memory 322, and may further include read-only memory (ROM) 323.

[0079] Storage unit 320 may also include a program / utility 324 having a set (at least one) of program modules 325, including but not limited to: an operating system, one or more application programs, other program modules, and program data, each or some combination of these examples may include an implementation of a network environment.

[0080] Bus 330 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

[0081] Electronic device 300 can also communicate with one or more external devices (e.g., keyboard, pointing device, Bluetooth device, etc.), one or more devices that enable a user to interact with electronic device 300, and / or any device that enables electronic device 300 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 350. Furthermore, electronic device 300 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 360. As shown, network adapter 360 communicates with other modules of electronic device 300 via bus 330. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 300, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0082] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0083] According to the present disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the methods described above is stored. In some possible embodiments, various aspects of the present invention can also be implemented as a program product comprising program code that, when the program product is run on a terminal device, causes the terminal device to perform the steps of the various exemplary embodiments of the present invention described in the "Exemplary Methods" section above.

[0084] refer to Figure 4 As shown, a program product 400 for implementing the above-described method according to an embodiment of the present invention is described. This product may employ a portable compact disc read-only memory (CD-ROM) and include program code, and may run on a terminal device, such as a personal computer. However, the program product of the present invention is not limited thereto. In this document, the readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0085] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0086] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting programs for use by or in conjunction with an instruction execution system, apparatus, or device.

[0087] The program code contained on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0088] Program code for performing the operations of this invention can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0089] Furthermore, the above figures are merely illustrative of the processes included in the method according to exemplary embodiments of the present invention, and are not intended to be limiting. It is readily understood that the processes shown in the above figures do not indicate or limit the temporal order of these processes. Additionally, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0090] The above description is merely a specific embodiment of this application, enabling those skilled in the art to understand or implement this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features claimed herein.

[0091] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

Claims

1. A method for detecting SQL injection attacks, characterized in that, include: Based on the abstract syntax tree generated by parsing the received SQL statement, semantic and syntactic encodings are performed on the nodes in the abstract syntax tree to obtain the semantic feature vector and syntactic feature vector of each node. The semantic feature vector and the syntactic feature vector are concatenated and fused to generate the initial features of each node; Based on the constructed sparse heterogeneous graph, the graph convolutional network is used to propagate the initial features between each node and its neighboring nodes to obtain the updated features of each node. The update features of the node are subjected to global average pooling to obtain the global representation vector of the SQL statement. The global representation vector is then input into a classifier to output the injection detection result of the SQL statement.

2. The method according to claim 1, characterized in that, The constructed sparse heterogeneous graph utilizes a graph convolutional network to propagate initial features between each node and its neighboring nodes, obtaining updated features for each node, including: Using the nodes of the abstract syntax tree as graph nodes and the parent-child and sibling edges in the abstract syntax tree as graph edges, a sparse heterogeneous graph is constructed. Based on the construction of a sparse heterogeneous graph, a fixed-layer graph convolutional network is used, and the neighbor aggregation range with a fixed number of hops set for each layer of the graph convolutional network is used to perform weighted average aggregation of the features of the neighbor nodes of each node, so that feature messages can be propagated between each node and its neighboring nodes to obtain the updated features of each node.

3. The method according to claim 1, characterized in that, The abstract syntax tree generated by parsing the received SQL statement is used to perform semantic and syntactic encoding on the nodes in the abstract syntax tree to obtain the semantic feature vector and syntactic feature vector of each node, including: The pre-trained Word2Vec model is used to vectorize the keywords and literals in the abstract syntax tree nodes, and TF-IDF weighting combined with random initialization is used to vectorize the tokens that are not keywords or literals, so as to obtain the semantic feature vectors of each node. One-hot encoding is performed on the syntax type of the nodes in the abstract syntax tree to obtain the syntax feature vector of each node.

4. The method according to claim 1, characterized in that, Before performing semantic and syntactic encoding on the nodes in the abstract syntax tree generated by parsing the received SQL statement to obtain the semantic feature vector and syntactic feature vector of each node, the process includes: Replace the literals in the SQL statement with uniform placeholders to generate an abstract syntax tree template hash. Perform a hash calculation on the abstract syntax tree template to obtain the hash value of the abstract syntax tree template; The first-level cache is queried using the hash value of the abstract syntax tree template as an index; If the first-level cache is hit, the injection detection result pre-stored in the SQL statement is returned directly.

5. The method according to claim 4, characterized in that, Also includes: If the first-level cache is not hit, the second-level cache is queried using the abstract syntax tree template hash and the ID of each node as indexes when retrieving the semantic feature vector of each node. If the second-level cache is hit, the semantic feature vector pre-stored by the node is directly retrieved; If the second-level cache is not hit, the semantic encoding step is performed, and the generated semantic vector is stored in the second-level cache.

6. The method according to claim 1, characterized in that, The step of concatenating and fusing the semantic feature vector and the syntactic feature vector to generate the initial features of each node includes: The semantic feature vector and the syntactic feature vector are concatenated end to end to obtain the concatenated feature vector; The linear transformation layer is used to map the feature vectors to a unified dimension, and the initial features of each node are output, which integrate syntactic and semantic information.

7. The method according to claim 1, characterized in that, The process of performing global average pooling on the updated features of the node to obtain a global representation vector of the SQL statement, and inputting the global representation vector into a classifier to output the injection detection result of the SQL statement, includes: Global average pooling or max pooling is performed on the update features of all nodes to obtain a global representation vector at the SQL level; The global representation vector is input into a two-layer fully connected classifier to output the detection result of whether the SQL statement is normal or injected.

8. A SQL injection attack detection device, characterized in that, include: The encoding module is used to perform semantic and syntactic encoding on the nodes in the abstract syntax tree generated by parsing the received SQL statement, so as to obtain the semantic feature vector and syntactic feature vector of each node. The concatenation module is used to concatenate and fuse the semantic feature vector and the grammatical feature vector to generate the initial features of each node; The processing module is used to propagate the initial features between each node and its neighboring nodes based on the constructed sparse heterogeneous graph using a graph convolutional network to obtain the updated features of each node. The verification module is used to perform global average pooling on the update features of the node to obtain the global representation vector of the SQL statement, and input the global representation vector into the classifier to output the injection detection result of the SQL statement.

9. An electronic device, characterized in that, The electronic device includes: processor; A memory storing computer-readable instructions that, when executed by the processor, implement the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, It stores computer program instructions that, when executed by a computer, cause the computer to perform the method according to any one of claims 1 to 7.

Images