76 results about "SQL injection" patented technology

The invention discloses a transaction management method and server based on dynamic SQL (Structured Query Language) processing, and the method comprises the steps: determining a to-be-executed business process in response to a received API (Application Program Interface) request of a user terminal; decomposing the business process to be executed into a plurality of process nodes; identifying a transaction node group in each process node, and declaring a joint transaction for all the transaction node groups; for each transaction node, obtaining a corresponding target SQL statement, and dynamically modifying the target SQL statement; executing the dynamically modified target SQL statement, and packaging the dynamically modified target SQL statement into a transaction operation unit under the condition that the dynamically modified target SQL statement belongs to the joint transaction; executing all the encapsulated transaction operation units, and submitting or rolling back the joint transaction to obtain an execution result; and returning an execution result to the user terminal. According to the method and the device, the problems of difficulty in dynamic SQL construction, SQL injection risk and poor maintainability can be effectively solved.

The invention discloses a database risk detection method and device, a storage medium and a terminal. In response to a database risk detection request triggered for the target access request, extracting a to-be-detected attack statement in the target access request through the large language model, and generating a to-be-detected vector of the to-be-detected attack statement; a target vector meeting a preset similar condition with the to-be-detected vector is inquired in a vector database, a target attack statement corresponding to the target vector is determined, and at least one vector corresponding to an attack statement used for executing the SQL injection attack is stored in the vector database; and outputting a query result corresponding to the target access request, wherein the query result comprises the target attack statement. When the detection request is triggered, the large language model extracts the to-be-detected attack statement, then the to-be-detected attack statement is vectorized through the vector model to generate the to-be-detected vector, the to-be-detected vector is compared with the vector corresponding to the attack statement in the database, and the result is obtained, so that the risk detection cost is reduced, and the detection accuracy is ensured.

The invention discloses an SQL (Structured Query Language) injection detection method and system based on a grammar and semantic feature fusion network and a storage medium. The method comprises the following steps of collecting a plurality of SQL injection samples as training data and preprocessing the training data; training a detection model by using the preprocessed training data, extracting semantic features of SQL statements of the training data by the detection model by using a BERT model, automatically extracting grammatical features by means of ChatGPT through a prompt project, and performing weighted fusion on the grammatical features by using a cross attention mechanism; and receiving to-be-detected traffic data, inputting the to-be-detected traffic data into the trained detection model for processing, and detecting the SQL injection attack in the to-be-detected traffic data. According to the method, the problem that a traditional SQL injection attack detection method is insufficient in capability of detecting novel and complex SQL injection attacks is solved, and the accuracy and efficiency of SQL injection attack detection are remarkably improved.

The embodiment of the invention provides an SQL injection attack protection method and device based on a zero-trust framework, and the method comprises the steps: tracking a current operation behavior of operation data in a zero-trust network, and determining whether the current operation behavior belongs to a to-be-verified behavior in the zero-trust network; if yes, calling a pre-trained linear support vector classifier (LSVC) model to detect the current operation behavior; if the detection result is the SQL injection attack, refusing the current operation behavior; wherein the pre-trained LSVC model is a model obtained by training according to a training data set, and the training data set comprises data of a plurality of malicious SQL injection attacks and normal data. The method provided by the embodiment of the invention solves the problems that the user experience is reduced and the management cost of an administrator is increased due to limitation of user input in the prior art.

The invention relates to an intelligent question counting method and device, electronic equipment and a storage medium, and belongs to the technical field of intelligent questions.The method comprises the steps that a query text input by a user and an MCP tool list are obtained; each MCP tool in the MCP tool list is constructed according to the interface description information of each back-end service interface; determining a query intention of the query text through the large language model, and determining a target MCP tool from the MCP tool list according to the query intention; calling a target service interface through the target MCP tool to obtain answer information from a rear end; and generating an answer text according to the answer information. The tedious question and answer pair configuration operation can be saved, the SQL injection risk is avoided, and better query flexibility is achieved.

The invention discloses an SQL injection detection method and device, equipment and a storage medium, and relates to the technical field of safety protection, and the method comprises the steps: obtaining an initial SQL statement input by a target user through a target Web application, and carrying out the preprocessing of the initial SQL statement, so as to obtain a corresponding target SQL statement; generating a corresponding token sequence based on the target SQL statement, and constructing a target abstract syntax tree corresponding to the target SQL statement; wherein the token sequence is a sequence generated based on each SQL element in the target SQL statement; and extracting a target feature corresponding to the target SQL statement based on the token sequence and the target abstract syntax tree, and detecting whether the target SQL statement has an injection attack behavior based on the target feature by using a pre-trained target graph neural network model. According to the method, high-accuracy, high-adaptability and low-delay SQL injection real-time detection can be realized.

The invention relates to the technical field of network security, in particular to an injection attack detection method based on multi-dimensional feature fusion and time optimization. The detection method comprises the following steps: acquiring character-level features and sub-word-level features of an HTTP request in a two-channel input mode; extracting multi-layer semantic information of the features by using a pre-training model; carrying out fusion processing on the features of different levels through a multi-dimensional feature fusion module; performing weight optimization on the fused features by using an adaptive feature attention module; applying a multi-scale cavity pooling module to extract multi-scale features; and performing time optimization on the model structure based on neural architecture search. According to the method, the detection accuracy of the Web application firewall on attacks such as SQL injection, XSS injection and RCE injection can be effectively improved, meanwhile, the real-time performance of the model is guaranteed, and the method is suitable for security protection in a high-concurrency Web application environment.

The invention discloses an SQL (Structured Query Language) injection attack detection method and system and related equipment, and relates to a network information security technology. The method comprises the steps that multiple collected SQL injection samples serve as training data to be preprocessed; performing three-stage training on the security big model by using the preprocessed training data; the first stage is to perform unsupervised pre-training by using the preprocessed training data, the second stage is to perform first fine tuning by using a Mixture of Experts architecture and a multi-task head form, and the third stage is to perform second fine tuning by using a comparative learning method; and receiving the to-be-detected traffic data, inputting the to-be-detected traffic data into the trained security detection large model, and detecting the SQL injection attack in the to-be-detected traffic data, thereby solving the technical problems that a traditional SQL injection attack detection method has obvious detection capability and insufficient flexibility for complex and changeable advanced SQL injection attacks, and improving the detection efficiency. The technical effect of remarkably improving the accuracy and efficiency of SQL injection attack detection is achieved.

This invention proposes an intelligent method for detecting abnormal network behavior, including acquiring target network traffic data, constructing a multi-dimensional feature fusion model based on an attention mechanism, and building an abnormal behavior classification model based on deep learning. By automatically allocating attention to different network traffic features through the attention mechanism, it solves the problems of unreasonable feature weight allocation and insufficient feature fusion in traditional methods, significantly improving the detection capability for low-frequency and covert abnormal behaviors and effectively reducing false positive and false negative rates. The classification model employs a hybrid CNN and LSTM structure, taking into account both the local spatial and temporal features of network traffic, and can accurately identify various types of abnormal network behaviors such as DDoS attacks, port scanning, SQL injection, and malicious code propagation, adapting to diverse attack scenarios with high classification accuracy.

The invention discloses an SQL injection and storage type XSS detection defense system and method. The method specifically comprises the steps that S1, static analysis is conducted, wherein Web application source codes are scanned, SQL statements in the source codes are positioned, and header identifiers HT and variable identifiers VT in the SQL statements and operation identifiers AT participating in arithmetic or function operation expressions in the SQL statements are recognized and added; s2, dynamic detection and defense: analyzing an identifier added for an SQL statement, executing pre-calculation processing on an operation expression with an operation identifier AT, and identifying SQL injection and storage type XSS attacks caused by the operation expression; defending when an attack is detected; and S3, removing the identifier in the SQL after defense is completed, recovering the SQL statement to a standard SQL statement, and submitting the SQL statement to a database for execution. According to the method, accurate detection and defense are carried out on the SQL statement containing the arithmetic or function operation expression, the detection accuracy is improved, and the false alarm rate is reduced.

The invention belongs to the technical field of network security protection, and discloses a malicious behavior bypass interception system based on flow analysis and detection, a rule engine quickly matches known attacks based on a dynamic feature library, such as SQL injection, common port scanning, federated learning model combined multi-node cooperative training, and flow time, behavior and content features are combined to realize the flow analysis and detection of malicious behaviors. Unknown threats such as 0day vulnerability variants and low-frequency hidden attacks are accurately captured; in an enterprise mixed service traffic environment, missed judgment of traditional static detection on unknown attacks can be avoided, false alarms caused by data limitation of a single model can be reduced, energy consumption of operation and maintenance personnel for processing invalid alarms is reduced, core assets are prevented from being damaged by novel attacks, and comprehensiveness and reliability of network protection are remarkably improved; a bypass deployment mode is adopted, traffic is obtained through network TAP equipment or traffic mirror images, a service main forwarding link does not need to be intervened, and network delay and single-point failure risks introduced by traditional series deployment are avoided.

The application discloses a database auditing system SQL injection detection method based on syntax tree comparison, and sequentially carries out SQL statement preprocessing, constructs a benchmark syntax tree, constructs a malicious syntax tree, compares and analyzes the benchmark syntax tree and the malicious syntax tree, judges attacks on the SQL statement corresponding to the malicious syntax tree, and carries out different early warning operations and generates a report according to the attack judgment. The SQL injection detection method can refine the detection level of SQL injection, carries out different operations on different SQL injection behaviors, prevents resource waste, has more resources for system defense, and improves the defense capability of the system.

The invention discloses an SQL (Structured Query Language) injection feature extraction method and system and a medium, and the method comprises the steps: initializing an original load feature vector, and inputting and traversing an original load data set; reading an original load, and defining a feature group as an SQL injection feature vector; basic scale features, grammar construction features, grammar interpretation features, complexity features, comprehensive description features and character separation features in the feature group are extracted in sequence; constructing a feature matrix, and outputting a standardized feature matrix; according to the method, the appropriate SQL injection features are selected, the stability and reliability of feature extraction are improved, the accuracy of machine learning model training is improved, the SQL injection detection effect is further improved, meanwhile, the calculation cost is reduced, and the method can be suitable for large-scale and high-speed network application scenes.

The present invention provides a web application protection method, system, and computer-readable storage medium. The method comprises: a front-end sending a data request to a back-end, the data request carrying a uniform resource locator (URL) and parameter information; upon receiving the data request, the back-end parsing the parameter information to obtain corresponding parameter values; and the back-end generating corresponding parameter images based on the parameter values, and saving the parameter images to a preset database. By graphically representing parameter values, the present invention can avoid web application risks caused by inserting malicious code into parameters, effectively defend against attacks such as cross-site scripting, SQL injection, file uploads, and brute force attacks, thereby improving the security of web applications and achieving comprehensive protection for web applications. This addresses the problem that existing web application protection methods lack comprehensive protection for web applications.

The present application discloses an AI-based intrusion protection response data processing method and server, which can collect the code of SQL instructions and analyze the code of the SQL instructions using data processing and semantic understanding algorithms based on artificial intelligence and deep learning, so as to capture and depict the abstract syntax tree semantic embedding representation of the SQL instruction code, and filter based on the correlation information between the embedded semantics of each node in the embedded representation, so as to purify the node embedded semantics with higher semantic expression quality to replace the original node. Then, the SQL code semantic encoding based on the tree-shaped long short-term memory network is performed on the abstract syntax tree semantic embedding representation after filtering and purification, so as to utilize the structured dependency relationship between each word in the enhanced SQL instruction code to achieve accurate identification and detection of SQL injection vulnerabilities. In this way, intrusion protection response data processing can be performed more intelligently, helping to automatically identify and detect SQL injection attacks, so as to solve the problem of Trojans from the source and enhance the security of the website.

This invention discloses a method, apparatus, device, and storage medium for detecting SQL injection attacks. The method includes the following steps: based on an abstract syntax tree generated by parsing a received SQL statement, semantically and syntactically encoding the nodes in the abstract syntax tree to obtain semantic feature vectors and syntactic feature vectors for each node; concatenating and fusing the semantic feature vectors and syntactic feature vectors to generate initial features for each node; based on a constructed sparse heterogeneous graph, using a graph convolutional network to propagate the initial features between each node and its neighboring nodes to obtain updated features for each node; performing global average pooling on the updated features of the nodes to obtain a global representation vector of the SQL statement, and inputting the global representation vector into a classifier to output the SQL injection detection result. This application can significantly reduce the computational resource requirements of the model while maintaining high detection accuracy.

The application discloses a SQL injection interception and illegal user identification method based on differential testing, which comprises the following steps: firstly, constructing a message information set containing SQL injection, and building an illegal user information record database; secondly, obtaining the IP address of each message information in the message information set, and inputting the IP address as a keyword into the illegal user information record database for interception discrimination; then, obtaining the keyword information of a target field in the message information which has not been intercepted, and performing differential testing on the keyword information; finally, screening the keyword information and user information such as the IP address in the differential testing case which does not pass, and storing the keyword information and user information into the illegal user information record database, so that the user is an illegal user. The application can actively intercept and record illegal operations of illegal users, effectively reduce the false negative rate, improve the interception rate, and improve the work efficiency of network security maintenance personnel.

This application discloses a method, computer device, and readable storage medium for determining SQL injection vulnerabilities in source code, belonging to the field of source code security detection technology. The method includes the following steps: responding to an SQL injection detection command in the source code, generating a set of legal input parameters based on a legal input scenario corresponding to the source code, and generating a set of test input parameters based on an injection statement library; wherein the injection statement library includes multiple injection statement templates; based on the set of legal input parameters and the source code, collecting first execution data through code instrumentation; based on the set of test input parameters and the source code, collecting second execution data through code instrumentation; and determining SQL injection vulnerabilities in the source code based on the first execution data and the second execution data. This application can reduce the false positive rate of SQL injection vulnerability detection and improve the targeting of SQL injection vulnerability detection.

The application discloses a kind of based on search enhancement SQL injection counter sample generation method, belong to traffic analysis and network security technical field.The application is divided into two links, first collect multiple sets of public traffic data set extraction SQL injection load, generate counter sample by a variety of variation mode, after structured cleaning, vectorization process builds SQL injection counter sample knowledge base.Second, rely on search enhancement generation technology, search similar sample and variation strategy in knowledge base, guide large language model iteration generates new counter sample, and effective sample is supplemented to knowledge base.Finally, normal traffic, original malicious sample and new counter sample are fused to construct training set, and the adversarial training of traffic detection model is completed.The application can improve the diversity and generation efficiency of counter sample, effectively strengthen the recognition ability and overall robustness of detection model to SQL injection variation attack.

The invention discloses a structured query statement injection attack identification method and device. The method comprises the steps of obtaining a to-be-recognized structured query statement; a first feature value corresponding to the to-be-recognized structured query statement is determined, and the first feature value is used for quantitatively representing a grammatical structure and a logic relation of the to-be-recognized structured query statement; the difference degree between the first feature value and a second feature value of a candidate template is determined, the candidate template comprises a sample structured query statement matched with the operation type of the to-be-recognized structured query statement, and the difference degree is used for quantitatively representing the structural similarity degree between the to-be-recognized structured query statement and the candidate template; and determining an identification result of the to-be-identified structured query statement according to the difference degree. According to the method and the device, the technical problem of low detection accuracy caused by matching based on a known attack feature code in an SQL injection detection method adopted in related technologies is solved.

The invention discloses a method for discovering SQL injection attack behaviors based on chaotic parting dimensions, and the method specifically comprises the steps: S1, data collection and feature extraction: obtaining HTTP request data, including SQL query data; extracting the characteristics of the SQL injection attack, wherein the characteristics comprise special characters, SQL keywords and potential malicious structures; s2, calculating a parting dimension; s3, setting a classification dimension threshold value, and if the classification dimension of the selected SQL statement is higher than the threshold value, judging that the SQL statement is an SQL injection attack; and S4, performing anomaly detection and response. The invention mainly relates to the technical field of network security, chaos theory and typing analysis. According to the method, the data is analyzed by using the typing dimension in the chaos theory, the accuracy and efficiency of attack detection are further improved, and nonlinear characteristics and complexity in an attack mode can be revealed, so that the method has advantages in coping with complex attacks.

This application provides a method and apparatus for testing server-side vulnerabilities in web applications. It effectively uncovers potential vulnerabilities through intelligent analysis and feedback mechanisms. By parsing web application pages, extracting key elements, and deriving field matching rules based on server feedback, it generates semantic input samples that conform to the application logic. By comparing historical execution paths, it automatically discovers new paths and further explores potential deep-seated vulnerabilities through mutation operations. This method not only improves test coverage and depth but also dynamically optimizes test samples based on actual feedback, avoiding the blindness and inefficiency of traditional testing methods. This solution can effectively identify various security vulnerabilities in web applications, such as SQL injection and XSS attacks, enhancing the security and reliability of web applications and providing developers with more accurate and efficient vulnerability detection methods.

The embodiment of the invention discloses an SQL (Structured Query Language) injection detection method, which comprises the following steps of: scanning an SQL statement word by word through a preset finite state automaton to obtain a machine lexical type of each lexical unit, constructing a lexical unit queue of the SQL statement on the basis of characters and lexical types of lexical units, and detecting the SQL (Structured Query Language). And obtaining a detection result through a pre-trained detection model for risk control. According to the method, an SQL statement is split through a state transition strategy of a finite state automaton to obtain lexical units, the problem that a regular matching mode cannot adapt to rapidly-changing attacks is avoided, meanwhile, due to the SQL injection principle, the mode for determining the lexical units and the types of the lexical units can effectively recognize zero-day attacks, and therefore the zero-day attacks can be effectively recognized. And the detection accuracy and efficiency of SQL injection are greatly improved.

The embodiment of the invention relates to the field of data processing, and provides an industrial sensitive data-oriented SQL injection response method, which comprises the following steps of: performing feature extraction on an SQL command uploaded by a client to obtain a first feature information set; calculating reasoning score information of an SQL command uploaded by a client according to first feature information in the first feature information set to obtain target score information; generating an injection response scheme corresponding to the SQL command uploaded by the client according to a preset score information threshold and the target score information to obtain a target response scheme; responding to an SQL command uploaded by the client according to the target response scheme to obtain a response result; the accuracy of performing injection response on the SQL uploaded by the client is improved.

The present disclosure provides a web injection attack detection method, device, electronic device and storage medium. It includes: pre-processing the flow data to obtain the URL and post body of the flow data; extracting the features of the URL and the post body by using a first neural network to obtain sequence features; extracting the features of the URL and the post body by using custom features to obtain discrete features; splicing the sequence features with the discrete features by a second neural network to obtain comprehensive features; and detecting web injection attacks by using a third neural network to detect the comprehensive features. This realizes large-scale real-time detection of SQL injection attacks, XSS attacks, and Command injection attacks, and effectively solves the problems in the prior art caused by difficulties in data collection, few training samples, and insufficient training, which leads to insufficient training, high model underreporting rate, and low accuracy.

The present invention relates to the field of gateway verification, and specifically to a security authentication gateway system and method based on AI analysis, comprising: a log verification module, an AI analysis module, a solid-state hardware module, a quantization decoding module and a conditional latch module, wherein the log verification module is used to obtain communication records and generate a verification matrix, the AI ​​analysis module is used to locate a target subnet and generate a signature function, the solid-state hardware module is used to build a physical communication link of a gateway, the quantization decoding module is used to confirm the sending and receiving time and decode data, and the conditional latch module is used to process a response signal and adjust the sending and receiving time of a data packet. The present invention can ensure the security of data transmission, prevent the influence of malicious traffic, DDoS attacks, SQL injection and other attack modes on gateway communication, and at the same time improve the communication speed of network communication, thereby ensuring the security and flexibility of a security verification gateway and reducing network management costs.

The invention relates to the technical field of network security, in particular to a Web authentication enhancement method and system based on user behavior analysis, and the method comprises the following steps: collecting multi-dimensional behavior data of a user, including login behavior data, access behavior data, operation behavior data and equipment fingerprint data; predefining a behavior rule base comprising a login time limit rule, an equipment fingerprint matching rule, an access frequency threshold rule and an operation path compliance rule; the method has the beneficial effects that the system can timely discover and prevent potential security threats, such as cross-site script attack, SQL injection attack, unauthorized access and the like, through predefined behavior rules and real-time comparison of user behaviors. The collection and analysis of the multi-dimensional behavior data enable the system to more comprehensively understand the behavior characteristics of the user, thereby improving the accuracy of authentication.

The embodiment of the invention provides an SQL injection detection test method and device, and the method comprises the steps: in a test scene of carrying out the SQL injection detection on a first application and a second application, sending a generated first abnormal statement to a to-be-tested interface of the first application to carry out request processing, and sending the generated first abnormal statement to the to-be-tested interface of the second application to carry out SQL injection detection on the to-be-tested interface of the first application; and sending a second SQL request containing the second abnormal statement to a to-be-tested interface of the second application for request processing, detecting a request parameter of the to-be-tested interface of the second application to obtain an abnormal request, and performing SQL injection detection on a request processing result of the abnormal request so as to realize SQL secondary injection detection in the test process.

The invention discloses an SQL (Structured Query Language) injection detection method and device, equipment and a storage medium. The method comprises the steps of obtaining a to-be-detected SQL statement; and for a target execution stage in the SQL statement execution process where the to-be-detected SQL statement is located, performing injection detection on the to-be-detected SQL statement in the target execution stage by adopting a target tangent matched with the target execution stage to obtain an injection detection result. According to the technical scheme, in the target execution stage in the SQL statement execution process where the to-be-detected SQL statement is located, the target tangent plane matched with the target execution stage is adopted to conduct injection detection on the to-be-detected SQL statement in the target execution stage, and therefore the injection detection result is obtained; the detection precision and the detection efficiency of the complex SQL injection attack can be obviously improved.

The application provides a network request risk detection method, system and server, and relates to the field of network request risk detection. The method performs feature fusion on an injection keyword matching result, a network request parameter statistical result and a network request character vectorization result corresponding to to-be-detected data, dynamically optimizes continuous features in the fused feature data, and realizes accurate detection of SQL injection risks in a network request process through a lightweight classifier.