A system and method for detecting injection attacks on super-long network requests of a power business system

Abstract

The application discloses a kind of injection attack detection system and method for power service system super-long network request, system includes: request analysis module, to HTTP request is parsed, obtains original request data;Length determination module, identifies super-long request, and generates data segment;Multi-dimensional feature extraction module, extracts syntax feature, structure feature and statistical feature, constructs multi-dimensional feature representation;Rule engine detection module, adopts rule engine to carry out hierarchical detection to data segment, and filters high-risk fragment;Large language model semantic analysis module, obtains semantic analysis result to high-risk fragment identification;Cross-segment correlation analysis module, high-risk request data segment is analyzed, and cross-segment correlation analysis result is output;Combination rule detection result, semantic analysis result and cross-segment correlation analysis result, by fusion decision mechanism comprehensive determination, output final detection result;The application improves the identification ability and accuracy to complex injection attack in super-long HTTP request.

Description

Technical Field

[0001] This invention belongs to the field of network security and web application protection technology, and in particular relates to an injection attack detection system and method for ultra-long network requests in power business systems. Background Technology

[0002] With the rapid development of web applications and internet services, business interactions based on the HTTP protocol have become increasingly complex, and code injection and SQL injection attacks have become one of the main threats to system security. Attackers construct malicious request parameters to trigger illegal code execution or database operations on the server side, thereby achieving attack objectives such as data theft and privilege escalation. In existing technologies, injection detection methods mainly rely on rule matching and feature recognition, such as detection mechanisms based on keywords, regular expressions, or feature libraries. These methods are effective in identifying known attack patterns, but they are less adaptable to complex and varied attacks such as encoding obfuscation, keyword splitting, and comment padding, and are prone to high false positive and false negative rates. On the other hand, with the continuous evolution of attack methods, attack payloads are gradually showing characteristics of ultra-long HTTP requests and distributed construction. Attackers split complete injection statements and embed them in different positions of the request, achieving their attack intent through context splicing. Existing detection systems typically use truncation or whole-process matching when handling ultra-long requests, making it difficult to effectively identify distributed attack fragments, leading to a decrease in detection capability. At the same time, the increase in request length also significantly increases the computational complexity of rule matching, affecting detection efficiency. Furthermore, existing methods primarily focus on syntactic feature matching, lacking a deep understanding of the semantics of request content, and thus have limited ability to identify covert execution intentions and cross-fragment related attacks. Therefore, there is an urgent need for a code and SQL injection detection technology that can effectively handle extremely long HTTP requests while balancing detection efficiency and accuracy, in order to improve the ability to identify complex attack scenarios. Summary of the Invention

[0003] Purpose of the invention: The purpose of this invention is to provide an injection attack detection system and method for ultra-long network requests in power business systems that can improve detection efficiency.

[0004] Technical solution: The present invention provides an injection attack detection system for ultra-long network requests in power business systems, comprising:

[0005] The request parsing module is used to parse the received HTTP request, extract the request method, URL path, request header, request body and parameter information, and assemble the raw request data.

[0006] The length determination module is used to determine the original request data based on a preset length threshold, and to identify HTTP requests that exceed the length threshold as excessively long requests.

[0007] The sliding window segmentation module is used to segment the long request according to a preset sliding window strategy, generating several request data fragments with contextual association.

[0008] The multidimensional feature extraction module is used to extract syntactic features, structural features and statistical features from each request data fragment, and to construct a corresponding feature representation for each request data fragment.

[0009] The rule engine detection module is used to perform hierarchical detection on the feature representation based on a preset injection attack rule library, and obtain the rule engine detection results for each request data fragment;

[0010] The risk screening module is used to filter out high-risk request data fragments based on the rule hit results, anomaly scores, and risk levels in the rule engine detection results.

[0011] The large language model semantic analysis module is used to perform semantic understanding and attack intent identification on the high-risk request data fragments to obtain semantic analysis results.

[0012] The cross-segment correlation analysis module is used to perform correlation analysis on high-risk request data segments and request data segments that are adjacent to or overlap with them, in order to identify distributed injection attack payloads and output cross-segment correlation analysis results.

[0013] The fusion decision module is used to fuse the detection results of the rule engine, the semantic analysis results, and the cross-segment association analysis results to generate the final detection and judgment results.

[0014] The response processing module is used to perform blocking, alarming, or allowing operations based on the final detection and judgment result.

[0015] Furthermore, the preset sliding window strategy of the sliding window segmentation module adopts a dynamic window adjustment mechanism based on the complexity of the requested content, specifically including:

[0016] The character distribution score, encoding change score, and parameter structure score are calculated based on the character distribution characteristics, encoding change frequency, and parameter structure complexity in the request data. The character distribution score, encoding change score, and parameter structure score are then normalized and weighted and summed to obtain the request complexity score.

[0017] When the request complexity score is greater than or equal to a preset complexity threshold, it is determined to be high complexity, and segmentation is performed using a first window length and a first sliding step; when the request complexity score is less than the preset complexity threshold, it is determined to be low complexity, and segmentation is performed using a second window length and a second sliding step; wherein, the first window length is less than the second window length, and the first sliding step is less than the second sliding step.

[0018] An overlap region with a preset ratio is set between adjacent data segments. The length of the overlap region is the product of the corresponding window length and the preset overlap ratio, in order to maintain the semantic continuity of the context.

[0019] Furthermore, the multi-dimensional feature extraction module extracts syntactic features, structural features, and statistical features from each request data fragment, and constructs a corresponding feature representation for each request data fragment, specifically as follows:

[0020] Normalize the grammatical features, structural features, and statistical features to construct a unified feature vector representation;

[0021] The syntactic features include the frequency of special characters, keyword distribution, and encoding anomaly patterns obtained from statistical analysis of request data fragments; the structural features include parameter nesting levels, data type distribution, and field length variation characteristics; and the statistical features include information entropy, character distribution uniformity, and outlier ratio.

[0022] Furthermore, the rule engine detection module includes:

[0023] The fast filtering layer is used to quickly filter matching requests based on preset whitelist rules and basic feature thresholds.

[0024] The precise matching layer is used to perform pattern matching on the feature representation based on a preset injection attack rule base to identify known attack features. The injection attack rule base is pre-configured according to known injection attack samples and the security policy of the power business system, and the injection attack rule base includes SQL injection keyword rules, code execution function rules, dangerous character combination rules, encoding obfuscation rules and regular expression matching rules.

[0025] The heuristic analysis layer is used to calculate an anomaly score by weighting the character distribution deviation, information entropy deviation, field length deviation, and encoding anomaly ratio of the request data that does not match the rules. The risk level is determined based on the comparison between the anomaly score and the preset anomaly score threshold, and the rule engine detection result is obtained.

[0026] Furthermore, the risk screening module filters out high-risk request data fragments, specifically as follows:

[0027] Request data segments that meet the injection attack rules, have an anomaly score greater than the preset anomaly score threshold, or have a high risk level are identified as high-risk request data segments.

[0028] Furthermore, the large language model semantic analysis module includes:

[0029] The high-risk request data fragments are preprocessed, including decoding and restoration, encoding normalization, and context supplementation.

[0030] Input information is constructed based on a preset prompt template, which includes request fragment content, context information, and attack feature description;

[0031] The constructed input information is fed into a pre-trained or finely tuned large language model based on injected attack sample instructions. The large language model is then used to perform semantic parsing on the pre-processed high-risk request data fragments to obtain the code execution intent, SQL operation logic, and key feature locations.

[0032] The code execution intent, SQL operation logic, and key feature locations are used as the basis for semantic analysis, and the corresponding semantic analysis results are output. The semantic analysis results include attack type determination, confidence score, and key feature location identification.

[0033] Furthermore, the cross-segment association analysis module includes:

[0034] Extract key feature identifiers from high-risk request data segments and request data segments that are adjacent to or overlap with them. The key feature identifiers include special character sequences, keyword distributions, and encoding patterns.

[0035] Calculate the similarity and correlation between different request data fragments based on the key feature identifiers;

[0036] Based on the similarity and relevance, a fragment association model is constructed. Specifically, the corresponding request data fragment is used as a node, and an association edge is established between fragments whose similarity and relevance both reach a preset association threshold or whose key features identify a continuous relationship. The corresponding request data fragments with an association path are identified as request data fragments with an association relationship.

[0037] Based on the aforementioned relationships, semantic splicing and context restoration are performed on related request data fragments to reconstruct the attack payload;

[0038] The reconstructed attack payload is subjected to overall attack intent analysis. Specifically, the reconstructed attack payload is matched with the injection attack rule base and semantic analysis results to determine the attack type, attack location and associated fragment set, which are used as the cross-segment association analysis results.

[0039] Furthermore, the fusion decision module includes:

[0040] The confidence scores of the rule engine detection results, semantic analysis results, and cross-segment association analysis results are evaluated to obtain the rule confidence score, semantic confidence score, and association analysis confidence score.

[0041] Based on a preset weight or dynamic weight adjustment mechanism, the confidence of the rule, the confidence of the semantics, and the confidence of the association analysis are weighted and calculated to obtain a comprehensive judgment score.

[0042] When the attack or non-attack categories corresponding to the rule engine detection results, semantic analysis results, and cross-segment association analysis results are consistent, or when at least two of the three have the same attack category and the corresponding confidence scores are all higher than the preset confidence threshold, it is determined that the analysis results are consistent, and the comprehensive judgment score and the corresponding attack category are used as the judgment result.

[0043] If the attack categories of any two of the rule engine detection results, semantic analysis results, and cross-segment association analysis results are inconsistent, or if the attack categories are consistent but the confidence difference is greater than the preset confidence difference threshold, it is determined that there is a conflict between the analysis results. The weights are adjusted in combination with the request context information and historical detection statistics, and the comprehensive judgment score is recalculated.

[0044] The comprehensive judgment score is compared with a preset attack threshold and a preset suspicious threshold. When the comprehensive judgment score is greater than or equal to the preset attack threshold, an attack judgment result is generated. When the comprehensive judgment score is less than the preset attack threshold but greater than or equal to the preset suspicious threshold, a suspicious judgment result is generated. When the comprehensive judgment score is less than the preset suspicious threshold, a normal judgment result is generated.

[0045] Based on the same inventive concept, this invention also provides a method for detecting injection attacks on ultra-long network requests in power business systems, including:

[0046] The received HTTP request is parsed to extract the request method, URL path, request headers, request body, and parameter information to form the original request data;

[0047] The original request data is judged based on a preset length threshold, and HTTP requests exceeding the length threshold are identified as excessively long requests.

[0048] The excessively long request is segmented according to a preset sliding window strategy to generate several request data segments with contextual relationships.

[0049] Syntactic features, structural features, and statistical features are extracted from each request data fragment, and a corresponding feature representation is constructed for each request data fragment.

[0050] Based on a preset injection attack rule base, the feature representation is subjected to hierarchical detection to obtain the rule engine detection results for each request data fragment;

[0051] High-risk request data segments are selected based on the rule hit results, anomaly scores, and risk levels in the rule engine detection results.

[0052] Semantic understanding and attack intent identification are performed on the high-risk request data fragments to obtain semantic analysis results;

[0053] Perform correlation analysis on high-risk request data segments and request data segments adjacent to or overlapping with them to identify distributed injection attack payloads and output cross-segment correlation analysis results;

[0054] The detection results from the rule engine, the semantic analysis results, and the cross-segment association analysis results are fused together to generate the final detection and judgment results.

[0055] Based on the final detection and judgment result, perform blocking, alarm, or release operations.

[0056] Furthermore, the semantic understanding and attack intent identification of the high-risk request data fragment to obtain semantic analysis results include:

[0057] The high-risk request data fragments are preprocessed, including decoding and restoration, encoding normalization, and context supplementation.

[0058] Input information is constructed based on a preset prompt template, which includes request fragment content, context information, and attack feature description;

[0059] The constructed input information is fed into a pre-trained or finely tuned large language model based on injected attack sample instructions. The large language model is then used to perform semantic parsing on the pre-processed high-risk request data fragments to obtain the code execution intent, SQL operation logic, and key feature locations.

[0060] The code execution intent, SQL operation logic, and key feature locations are used as the basis for semantic analysis, and the corresponding semantic analysis results are output. The semantic analysis results include attack type determination, confidence score, and key feature location identification.

[0061] The process of fusing the rule engine detection results, semantic analysis results, and cross-segment association analysis results to generate the final detection and judgment result includes:

[0062] The confidence scores of the rule engine detection results, semantic analysis results, and cross-segment association analysis results are evaluated to obtain the rule confidence score, semantic confidence score, and association analysis confidence score.

[0063] Based on a preset weight or dynamic weight adjustment mechanism, the confidence of the rule, the confidence of the semantics, and the confidence of the association analysis are weighted and calculated to obtain a comprehensive judgment score.

[0064] When the attack or non-attack categories corresponding to the rule engine detection results, semantic analysis results, and cross-segment association analysis results are consistent, or when at least two of the three have the same attack category and the corresponding confidence scores are all higher than the preset confidence threshold, it is determined that the analysis results are consistent, and the comprehensive judgment score and the corresponding attack category are used as the judgment result.

[0065] If the attack categories of any two of the rule engine detection results, semantic analysis results, and cross-segment association analysis results are inconsistent, or if the attack categories are consistent but the confidence difference is greater than the preset confidence difference threshold, it is determined that there is a conflict between the analysis results. The weights are adjusted in combination with the request context information and historical detection statistics, and the comprehensive judgment score is recalculated.

[0066] The comprehensive judgment score is compared with a preset attack threshold and a preset suspicious threshold. When the comprehensive judgment score is greater than or equal to the preset attack threshold, an attack judgment result is generated. When the comprehensive judgment score is less than the preset attack threshold but greater than or equal to the preset suspicious threshold, a suspicious judgment result is generated. When the comprehensive judgment score is less than the preset suspicious threshold, a normal judgment result is generated.

[0067] Beneficial Effects: Compared with existing technologies, this invention avoids the problems of decreased detection efficiency and attack payload truncation that occur in traditional overall matching methods when dealing with ultra-long HTTP requests by determining the length of the request and processing it through a sliding window. By extracting syntactic, structural, and statistical features from request data fragments and combining them with a rule engine for layered detection, it can quickly identify known attack patterns and abnormal behaviors. Furthermore, by introducing a large language model to perform semantic understanding and attack intent analysis on high-risk request data fragments, and combining it with a fusion decision-making mechanism and a cross-segment association restoration mechanism, a complete technical solution integrating local detection, semantic analysis, comprehensive judgment, and global association identification is formed. This not only improves the detection accuracy of code injection and SQL injection attacks, but also enhances the ability to identify ultra-long requests, distributed attack payloads, and obfuscated attack behaviors, significantly reducing false positive and false negative rates, and improving the intelligent processing capabilities and engineering application value of web application security protection systems in complex attack scenarios. Attached Figure Description

[0068] Figure 1 This is a system framework diagram of an embodiment of the present invention;

[0069] Figure 2 This is a flowchart of a method according to an embodiment of the present invention. Detailed Implementation

[0070] To enable those skilled in the art to better understand the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings.

[0071] Example 1, such as Figure 1 As shown in this embodiment, the injection attack detection system for ultra-long network requests in power business systems includes:

[0072] The request parsing module is used to parse the received HTTP request, extract the request method, URL path, request header, request body and parameter information, and assemble the raw request data.

[0073] The length determination module is used to determine the original request data based on a preset length threshold, and to identify HTTP requests that exceed the length threshold as excessively long requests.

[0074] The sliding window segmentation module is used to segment the long request according to a preset sliding window strategy, generating several request data fragments with contextual association.

[0075] The multidimensional feature extraction module is used to extract syntactic features, structural features and statistical features from each request data fragment, and to construct a corresponding feature representation for each request data fragment.

[0076] The rule engine detection module is used to perform hierarchical detection on the feature representation based on a preset injection attack rule library, and obtain the rule engine detection results for each request data fragment;

[0077] The risk screening module is used to filter out high-risk request data fragments based on the rule hit results, anomaly scores, and risk levels in the rule engine detection results.

[0078] The large language model semantic analysis module is used to perform semantic understanding and attack intent identification on the high-risk request data fragments to obtain semantic analysis results.

[0079] The cross-segment correlation analysis module is used to perform correlation analysis on high-risk request data segments and request data segments that are adjacent to or overlap with them, in order to identify distributed injection attack payloads and output cross-segment correlation analysis results.

[0080] The fusion decision module is used to fuse the detection results of the rule engine, the semantic analysis results, and the cross-segment association analysis results to generate the final detection and judgment results.

[0081] The response processing module is used to perform blocking, alarming, or allowing operations based on the final detection and judgment result.

[0082] Furthermore, the preset sliding window strategy of the sliding window segmentation module adopts a dynamic window adjustment mechanism based on the complexity of the requested content, specifically including:

[0083] The character distribution score, encoding change score, and parameter structure score are calculated based on the character distribution characteristics, encoding change frequency, and parameter structure complexity in the request data. The character distribution score, encoding change score, and parameter structure score are then normalized and weighted and summed to obtain the request complexity score.

[0084] When the request complexity score is greater than or equal to a preset complexity threshold, it is determined to be high complexity, and segmentation is performed using a first window length and a first sliding step; when the request complexity score is less than the preset complexity threshold, it is determined to be low complexity, and segmentation is performed using a second window length and a second sliding step; wherein, the first window length is less than the second window length, and the first sliding step is less than the second sliding step;

[0085] An overlap region with a preset ratio is set between adjacent data segments. The length of the overlap region is the product of the corresponding window length and the preset overlap ratio, in order to maintain the semantic continuity of the context.

[0086] Furthermore, the multi-dimensional feature extraction module extracts syntactic features, structural features, and statistical features from each request data fragment, and constructs a corresponding feature representation for each request data fragment, specifically as follows:

[0087] Syntactic features, structural features, and statistical features are normalized to construct a unified feature vector representation, which is the feature representation.

[0088] The syntactic features include the frequency of special characters, keyword distribution, and encoding anomaly patterns obtained from statistical analysis of request data fragments; the structural features include parameter nesting levels, data type distribution, and field length variation characteristics; and the statistical features include information entropy, character distribution uniformity, and outlier ratio.

[0089] Furthermore, the rule engine detection module includes:

[0090] The fast filtering layer is used to quickly filter matching requests based on preset whitelist rules and basic feature thresholds.

[0091] The precise matching layer is used to perform pattern matching on the feature representation based on a preset injection attack rule base to identify known attack features. The injection attack rule base is pre-configured according to known injection attack samples and the security policy of the power business system, and the injection attack rule base includes SQL injection keyword rules, code execution function rules, dangerous character combination rules, encoding obfuscation rules and regular expression matching rules.

[0092] The heuristic analysis layer is used to calculate an anomaly score by weighting the character distribution deviation, information entropy deviation, field length deviation, and encoding anomaly ratio of the request data that does not match the rules. The risk level is determined based on the comparison between the anomaly score and the preset anomaly score threshold, and the rule engine detection result is obtained.

[0093] Furthermore, the risk screening module filters out high-risk request data fragments, specifically as follows:

[0094] Request data segments that meet the injection attack rules, have an anomaly score greater than the preset anomaly score threshold, or have a high risk level are identified as high-risk request data segments.

[0095] Furthermore, the large language model semantic analysis module includes:

[0096] The high-risk request data fragments are preprocessed, including decoding and restoration, encoding normalization, and context supplementation.

[0097] Input information is constructed based on a preset prompt template, which includes request fragment content, context information, and attack feature description;

[0098] The constructed input information is fed into a pre-trained or finely tuned large language model based on injected attack sample instructions. The large language model is then used to perform semantic parsing on the pre-processed high-risk request data fragments to obtain the code execution intent, SQL operation logic, and key feature locations.

[0099] The code execution intent, SQL operation logic, and key feature locations are used as the basis for semantic analysis, and the corresponding semantic analysis results are output. The semantic analysis results include attack type determination, confidence score, and key feature location identification.

[0100] Furthermore, the cross-segment association analysis module includes:

[0101] Extract key feature identifiers from high-risk request data segments and request data segments that are adjacent to or overlap with them. The key feature identifiers include special character sequences, keyword distributions, and encoding patterns.

[0102] Calculate the similarity and correlation between different request data fragments based on the key feature identifiers;

[0103] Based on the similarity and relevance, a fragment association model is constructed. Specifically, the corresponding request data fragment is used as a node, and an association edge is established between fragments whose similarity and relevance both reach a preset association threshold or whose key features identify a continuous relationship. The corresponding request data fragments with an association path are identified as request data fragments with an association relationship.

[0104] Based on the aforementioned relationships, semantic splicing and context restoration are performed on related request data fragments to reconstruct the attack payload;

[0105] The reconstructed attack payload is subjected to overall attack intent analysis. Specifically, the reconstructed attack payload is matched with the injection attack rule base and semantic analysis results to determine the attack type, attack location and associated fragment set, which are used as the cross-segment association analysis results.

[0106] Furthermore, the fusion decision module includes:

[0107] The confidence scores of the rule engine detection results, semantic analysis results, and cross-segment association analysis results are evaluated to obtain the rule confidence score, semantic confidence score, and association analysis confidence score.

[0108] Based on a preset weight or dynamic weight adjustment mechanism, the confidence of the rule, the confidence of the semantics, and the confidence of the association analysis are weighted and calculated to obtain a comprehensive judgment score.

[0109] When the attack or non-attack categories corresponding to the rule engine detection results, semantic analysis results, and cross-segment association analysis results are consistent, or when at least two of the three have the same attack category and the corresponding confidence scores are all higher than the preset confidence threshold, it is determined that the analysis results are consistent, and the comprehensive judgment score and the corresponding attack category are used as the judgment result.

[0110] If the attack categories of any two of the rule engine detection results, semantic analysis results, and cross-segment association analysis results are inconsistent, or if the attack categories are consistent but the confidence difference is greater than the preset confidence difference threshold, it is determined that there is a conflict between the analysis results. The weights are adjusted in combination with the request context information and historical detection statistics, and the comprehensive judgment score is recalculated.

[0111] The comprehensive judgment score is compared with a preset attack threshold and a preset suspicious threshold. When the comprehensive judgment score is greater than or equal to the preset attack threshold, an attack judgment result is generated. When the comprehensive judgment score is less than the preset attack threshold but greater than or equal to the preset suspicious threshold, a suspicious judgment result is generated. When the comprehensive judgment score is less than the preset suspicious threshold, a normal judgment result is generated.

[0112] Example 2: This example provides a complete implementation process of an injection attack detection system and method for ultra-long network requests in power business systems, such as... Figure 2 As shown, the specific steps include:

[0113] Step 1: Request parsing and length determination;

[0114] In the actual testing process, after receiving an HTTP request from the client, the system first parses the request using an HTTP protocol parsing component (such as the Nginx parsing module or a custom parsing program) to extract information such as the request method, URL path, query parameters, request headers, and request body, obtaining the raw request data. Subsequently, the raw request data is judged based on a preset length threshold, which can be set to 3-5 times the average request length according to historical normal request statistics. When the request length exceeds the threshold, it is identified as an oversized HTTP request and enters the deep testing process; otherwise, it enters the regular testing process.

[0115] Step 2: Segment processing of the sliding window;

[0116] For extremely long HTTP requests, a sliding window segmentation strategy is employed to divide the original request data. First, the complexity of the request content is assessed, with evaluation metrics including character distribution characteristics, encoding change frequency, and parameter structure complexity. Based on the assessment results, the window length and sliding step size are dynamically adjusted. For example, a smaller window (e.g., 256 bytes) and a smaller step size (e.g., 128 bytes) are used for high complexity, while a larger window (e.g., 1024 bytes) and a larger step size (e.g., 512 bytes) are used for low complexity. Simultaneously, a certain percentage of overlap (e.g., 50%) is established between adjacent segments to ensure the continuity of contextual semantics. Finally, multiple sequences of request data segments with contextual relationships are generated.

[0117] Step 3: Multidimensional feature extraction;

[0118] Multidimensional feature extraction is performed on the request data fragments obtained in step 2. Specifically, this includes: syntactic feature extraction, such as the frequency of special characters (single quotes, double quotes, semicolons, etc.), SQL keyword distribution, and encoding anomaly patterns; structural feature extraction, such as parameter nesting levels, data type distribution, and field length variations; and statistical feature extraction, such as information entropy, character distribution uniformity, and outlier ratio. These features are then normalized, and a unified feature vector representation is constructed for subsequent detection and analysis.

[0119] Step 4: Rule engine layered detection;

[0120] The feature vectors are input into a rule engine for layered detection. The rule engine includes a fast filtering layer, a precise matching layer, and a heuristic analysis layer. The fast filtering layer quickly identifies obviously normal requests based on whitelist rules and basic feature thresholds; the precise matching layer performs pattern matching on the request data based on a predefined injection attack rule base to identify known attack characteristics; the heuristic analysis layer scores the request data that does not match the rules and determines the risk level based on the scoring results. Finally, the preliminary risk assessment results for each request data segment are output.

[0121] Step 5: Risk screening and semantic analysis of high-risk segments;

[0122] Based on the preliminary risk assessment results obtained in step 4, the requested data fragments are screened for risk. Low-risk data fragments can be directly allowed or recorded; high-risk data fragments proceed to a deep analysis process. Specifically, high-risk data fragments undergo preprocessing, including decoding, encoding normalization, and context supplementation. Subsequently, input information is constructed based on a preset prompt template, and the high-risk fragments are input into a pre-trained large language model for semantic analysis. The prompt template guides the model to identify the code execution intent and SQL operation logic. The large language model parses the request fragments using its semantic understanding capabilities and outputs semantic analysis results, including attack type determination, corresponding confidence score, and key feature location identifiers.

[0123] Step 6: Cross-segment association analysis;

[0124] After obtaining the semantic analysis results of high-risk request data fragments, further cross-segment association analysis is performed on multiple request data fragments. Specifically, key feature identifiers are extracted from each request data fragment, including special character sequences, keyword distribution, encoding patterns, and key position identifiers obtained from semantic analysis. The similarity and correlation between different request data fragments are then calculated. Based on the association results, a fragment relationship model is constructed. Semantic splicing and context restoration are performed on request data fragments with correlation to reconstruct the complete attack payload. Attack intent analysis is then performed on the reconstructed overall content, thereby improving the ability to identify distributed injection attacks and obfuscation injection attacks.

[0125] Step 7: Integrate decision-making and outcome output;

[0126] The system comprehensively evaluates the results of rule engine detection, semantic analysis, and cross-segment correlation analysis, and then fuses them based on preset weights or a dynamic weight adjustment mechanism to obtain a comprehensive judgment score. When the analysis results are consistent, the corresponding judgment result is directly output; when there are conflicts between different analysis results, the weights of each item are adjusted by combining request context information, historical detection data, and correlation analysis results, and the comprehensive judgment score is recalculated. Based on the comparison between the comprehensive judgment score and a preset threshold, the final detection result is generated, and corresponding response operations are executed, including blocking the request, generating an alarm, or allowing the request.

[0127] Example 3: This example provides a specific implementation scheme for an injection attack detection system and method for ultra-long network requests in power business systems. The system can be deployed in a Web Application Firewall (WAF), API gateway, or security detection platform for real-time detection and analysis of HTTP requests accessing through network interfaces.

[0128] The system runs on an electronic device, which includes a processor, a memory, and a network interface. The memory stores program instructions that can be executed by the processor. When executed, the program instructions enable the coordinated operation of the following functional modules:

[0129] During operation, the system first receives HTTP request traffic through the network interface. The request parsing module then performs standardized parsing on the requests, extracting information such as the request path, parameters, request headers, and request body to form a unified data representation format. The parsed data is transmitted to the length determination module, which compares it with a preset length threshold to classify requests into two categories: normal requests and excessively long requests. Excessively long requests are marked as key targets for detection.

[0130] For marked excessively long requests, the system schedules a sliding window segmentation module to process them into segments. This module dynamically adjusts the window size and sliding step size based on the complexity of the request content, and preserves overlapping areas between segments during the segmentation process to ensure the continuity of contextual information. The segmented request data is then passed to subsequent processing modules in the form of a sequence of segments.

[0131] Subsequently, the multi-dimensional feature extraction module processes each request data fragment in parallel, extracting feature information from three dimensions: syntax, structure, and statistics, and constructing standardized feature vectors. These feature vectors are input into the rule engine detection module. The rule engine analyzes the request fragments using a hierarchical detection strategy, quickly identifying obviously normal requests and performing fine-grained matching and anomaly detection on suspicious fragments, thereby outputting preliminary risk assessment results. The system can also perform risk screening on the request data fragments based on these preliminary risk assessment results, directly allowing or recording low-risk request data fragments, while sending high-risk request data fragments to subsequent in-depth analysis processes.

[0132] For request data fragments identified as high-risk, the system further invokes the large language model semantic analysis module for in-depth analysis. This module organizes the input fragments based on preset prompt templates and performs decoding, encoding normalization, and context supplementation processing on the request data fragments. Through semantic understanding, it identifies potential code execution behaviors or SQL operation logic and outputs semantic analysis results including attack type, confidence score, and key feature location identifiers.

[0133] After obtaining the semantic analysis results of high-risk request data segments, the system calls the cross-segment correlation analysis module to model the correlation between multiple request data segments. This module extracts information such as special character sequences, keyword distribution, encoding patterns, and key feature location identifiers from each request data segment, calculates the similarity and correlation between different request data segments, and performs semantic splicing and context restoration on multiple request data segments based on the correlation to reconstruct the distributed attack payload, thereby identifying the overall attack behavior hidden in multiple request data segments.

[0134] During the result determination phase, the fusion decision module performs unified processing on the rule engine detection results, semantic analysis results, and cross-segment correlation analysis results. This module performs weighted fusion based on the confidence levels of different detection results, and dynamically adjusts the weights when conflicting results exist, incorporating request context information, historical detection data, and correlation analysis results to arrive at the final determination result. The determination result is then passed to the response processing module to perform operations such as blocking requests, triggering alarms, or allowing access.

[0135] In practical deployment, this system supports a distributed architecture, allowing modules such as request parsing, feature extraction, rule detection, semantic analysis, and correlation analysis to be deployed on different computing nodes. Parallel processing is achieved through load balancing and task scheduling mechanisms to meet the real-time detection requirements of high-concurrency network environments. Simultaneously, the system can incorporate a caching mechanism to reuse the results of analyzed similar requests, further improving overall processing efficiency.

Claims

1. A system for detecting injection attacks on ultra-long network requests in power business systems, characterized in that, include: The request parsing module is used to parse the received HTTP request, extract the request method, URL path, request header, request body and parameter information, and assemble the raw request data. The length determination module is used to determine the original request data based on a preset length threshold, and to identify HTTP requests that exceed the length threshold as excessively long requests. The sliding window segmentation module is used to segment the long request according to a preset sliding window strategy, generating several request data fragments with contextual association. The multidimensional feature extraction module is used to extract syntactic features, structural features and statistical features from each request data fragment, and to construct a corresponding feature representation for each request data fragment. The rule engine detection module is used to perform hierarchical detection on the feature representation based on a preset injection attack rule library, and obtain the rule engine detection results for each request data fragment; The risk screening module is used to filter out high-risk request data fragments based on the rule hit results, anomaly scores, and risk levels in the rule engine detection results. The large language model semantic analysis module is used to perform semantic understanding and attack intent identification on the high-risk request data fragments to obtain semantic analysis results. The cross-segment correlation analysis module is used to perform correlation analysis on high-risk request data segments and request data segments that are adjacent to or overlap with them, in order to identify distributed injection attack payloads and output cross-segment correlation analysis results. The fusion decision module is used to fuse the detection results of the rule engine, the semantic analysis results, and the cross-segment association analysis results to generate the final detection and judgment results. The response processing module is used to perform blocking, alarming, or allowing operations based on the final detection and judgment result.

2. The injection attack detection system for ultra-long network requests in power business systems according to claim 1, characterized in that, The preset sliding window strategy of the sliding window segmentation module adopts a dynamic window adjustment mechanism based on the complexity of the request content, specifically including: The character distribution score, encoding change score, and parameter structure score are calculated based on the character distribution characteristics, encoding change frequency, and parameter structure complexity in the request data. The character distribution score, encoding change score, and parameter structure score are then normalized and weighted and summed to obtain the request complexity score. When the request complexity score is greater than or equal to a preset complexity threshold, it is determined to be high complexity, and segmentation is performed using a first window length and a first sliding step; when the request complexity score is less than the preset complexity threshold, it is determined to be low complexity, and segmentation is performed using a second window length and a second sliding step; wherein, the first window length is less than the second window length, and the first sliding step is less than the second sliding step. An overlap region with a preset ratio is set between adjacent data segments. The length of the overlap region is the product of the corresponding window length and the preset overlap ratio, in order to maintain the semantic continuity of the context.

3. The injection attack detection system for ultra-long network requests in power business systems according to claim 1, characterized in that, The multi-dimensional feature extraction module extracts syntactic features, structural features, and statistical features from each request data fragment, and constructs a corresponding feature representation for each request data fragment, specifically as follows: Normalize the grammatical features, structural features, and statistical features to construct a unified feature vector representation; The syntactic features include the frequency of special characters, keyword distribution, and encoding anomaly patterns obtained from statistical analysis of request data fragments; the structural features include parameter nesting levels, data type distribution, and field length variation characteristics; and the statistical features include information entropy, character distribution uniformity, and outlier ratio.

4. The injection attack detection system for ultra-long network requests in power business systems according to claim 1, characterized in that, The rule engine detection module includes: The fast filtering layer is used to quickly filter matching requests based on preset whitelist rules and basic feature thresholds. The precise matching layer is used to perform pattern matching on the feature representation based on a preset injection attack rule base to identify known attack features. The injection attack rule base is pre-configured according to known injection attack samples and the security policy of the power business system, and the injection attack rule base includes SQL injection keyword rules, code execution function rules, dangerous character combination rules, encoding obfuscation rules and regular expression matching rules. The heuristic analysis layer is used to calculate an anomaly score by weighting the character distribution deviation, information entropy deviation, field length deviation, and encoding anomaly ratio of the request data that does not match the rules. The risk level is determined based on the comparison between the anomaly score and the preset anomaly score threshold, and the rule engine detection result is obtained.

5. The injection attack detection system for ultra-long network requests in power business systems according to claim 1, characterized in that, The risk screening module filters out high-risk request data fragments, specifically as follows: Request data segments that meet the injection attack rules, have an anomaly score greater than the preset anomaly score threshold, or have a high risk level are identified as high-risk request data segments.

6. The injection attack detection system for ultra-long network requests in power business systems according to claim 1, characterized in that, The semantic analysis module of the large language model includes: The high-risk request data fragments are preprocessed, including decoding and restoration, encoding normalization, and context supplementation. Input information is constructed based on a preset prompt template, which includes request fragment content, context information, and attack feature description; The constructed input information is fed into a pre-trained or finely tuned large language model based on injected attack sample instructions. The large language model is then used to perform semantic parsing on the pre-processed high-risk request data fragments to obtain the code execution intent, SQL operation logic, and key feature locations. The code execution intent, SQL operation logic, and key feature locations are used as the basis for semantic analysis, and the corresponding semantic analysis results are output. The semantic analysis results include attack type determination, confidence score, and key feature location identification.

7. The injection attack detection system for ultra-long network requests in power business systems according to claim 1, characterized in that, The cross-segment association analysis module includes: Extract key feature identifiers from high-risk request data segments and request data segments that are adjacent to or overlap with them. The key feature identifiers include special character sequences, keyword distributions, and encoding patterns. Calculate the similarity and correlation between different request data fragments based on the key feature identifiers; Based on the similarity and relevance, a fragment association model is constructed. Specifically, the corresponding request data fragment is used as a node, and an association edge is established between fragments whose similarity and relevance both reach a preset association threshold or whose key features identify a continuous relationship. The corresponding request data fragments with an association path are identified as request data fragments with an association relationship. Based on the aforementioned relationships, semantic splicing and context restoration are performed on related request data fragments to reconstruct the attack payload; The reconstructed attack payload is subjected to overall attack intent analysis. Specifically, the reconstructed attack payload is matched with the injection attack rule base and semantic analysis results to determine the attack type, attack location and associated fragment set, which are used as the cross-segment association analysis results.

8. The injection attack detection system for ultra-long network requests in power business systems according to claim 1, characterized in that, The fusion decision module includes: The confidence scores of the rule engine detection results, semantic analysis results, and cross-segment association analysis results are evaluated to obtain the rule confidence score, semantic confidence score, and association analysis confidence score. Based on a preset weight or dynamic weight adjustment mechanism, the confidence of the rule, the confidence of the semantics, and the confidence of the association analysis are weighted and calculated to obtain a comprehensive judgment score. When the attack or non-attack categories corresponding to the rule engine detection results, semantic analysis results, and cross-segment association analysis results are consistent, or when at least two of the three have the same attack category and the corresponding confidence scores are all higher than the preset confidence threshold, it is determined that the analysis results are consistent, and the comprehensive judgment score and the corresponding attack category are used as the judgment result. If the attack categories of any two of the rule engine detection results, semantic analysis results, and cross-segment association analysis results are inconsistent, or if the attack categories are consistent but the confidence difference is greater than the preset confidence difference threshold, it is determined that there is a conflict between the analysis results. The weights are adjusted in combination with the request context information and historical detection statistics, and the comprehensive judgment score is recalculated. The comprehensive judgment score is compared with a preset attack threshold and a preset suspicious threshold. When the comprehensive judgment score is greater than or equal to the preset attack threshold, an attack judgment result is generated. When the comprehensive judgment score is less than the preset attack threshold but greater than or equal to the preset suspicious threshold, a suspicious judgment result is generated. When the comprehensive judgment score is less than the preset suspicious threshold, a normal judgment result is generated.

9. A method for detecting injection attacks on ultra-long network requests in power business systems, characterized in that, include: The received HTTP request is parsed to extract the request method, URL path, request headers, request body, and parameter information to form the original request data; The original request data is judged based on a preset length threshold, and HTTP requests exceeding the length threshold are identified as excessively long requests. The excessively long request is segmented according to a preset sliding window strategy to generate several request data segments with contextual relationships. Syntactic features, structural features, and statistical features are extracted from each request data fragment, and a corresponding feature representation is constructed for each request data fragment. Based on a preset injection attack rule base, the feature representation is subjected to hierarchical detection to obtain the rule engine detection results for each request data fragment; High-risk request data segments are selected based on the rule hit results, anomaly scores, and risk levels in the rule engine detection results. Semantic understanding and attack intent identification are performed on the high-risk request data fragments to obtain semantic analysis results; Perform correlation analysis on high-risk request data segments and request data segments adjacent to or overlapping with them to identify distributed injection attack payloads and output cross-segment correlation analysis results; The detection results from the rule engine, the semantic analysis results, and the cross-segment association analysis results are fused together to generate the final detection and judgment results. Based on the final detection and judgment result, perform blocking, alarm, or release operations.

10. The injection attack detection method for ultra-long network requests in power business systems according to claim 9, characterized in that, The semantic understanding and attack intent identification of the high-risk request data fragments, to obtain semantic analysis results, include: The high-risk request data fragments are preprocessed, including decoding and restoration, encoding normalization, and context supplementation. Input information is constructed based on a preset prompt template, which includes request fragment content, context information, and attack feature description; The constructed input information is fed into a pre-trained or finely tuned large language model based on injected attack sample instructions. The large language model is then used to perform semantic parsing on the pre-processed high-risk request data fragments to obtain the code execution intent, SQL operation logic, and key feature locations. The code execution intent, SQL operation logic, and key feature locations are used as the basis for semantic analysis, and the corresponding semantic analysis results are output. The semantic analysis results include attack type determination, confidence score, and key feature location identification. The process of fusing the rule engine detection results, semantic analysis results, and cross-segment association analysis results to generate the final detection and judgment result includes: The confidence scores of the rule engine detection results, semantic analysis results, and cross-segment association analysis results are evaluated to obtain the rule confidence score, semantic confidence score, and association analysis confidence score. Based on a preset weight or dynamic weight adjustment mechanism, the confidence of the rule, the confidence of the semantics, and the confidence of the association analysis are weighted and calculated to obtain a comprehensive judgment score. When the attack or non-attack categories corresponding to the rule engine detection results, semantic analysis results, and cross-segment association analysis results are consistent, or when at least two of the three have the same attack category and the corresponding confidence scores are all higher than the preset confidence threshold, it is determined that the analysis results are consistent, and the comprehensive judgment score and the corresponding attack category are used as the judgment result. If the attack categories of any two of the rule engine detection results, semantic analysis results, and cross-segment association analysis results are inconsistent, or if the attack categories are consistent but the confidence difference is greater than the preset confidence difference threshold, it is determined that there is a conflict between the analysis results. The weights are adjusted in combination with the request context information and historical detection statistics, and the comprehensive judgment score is recalculated. The comprehensive judgment score is compared with a preset attack threshold and a preset suspicious threshold. When the comprehensive judgment score is greater than or equal to the preset attack threshold, an attack judgment result is generated. When the comprehensive judgment score is less than the preset attack threshold but greater than or equal to the preset suspicious threshold, a suspicious judgment result is generated. When the comprehensive judgment score is less than the preset suspicious threshold, a normal judgment result is generated.

Images