94 results about "SQL injection" patented technology

The invention discloses an AI-based intrusion protection response data processing method and a server, which can analyze a code of an SQL (Structured Query Language) instruction by collecting the code of the SQL instruction and utilizing a data processing and semantic comprehension algorithm based on artificial intelligence and deep learning. According to the method, abstract syntax tree semantic embedding representation of SQL instruction codes is captured and depicted, filtering is carried out on the basis of association information between node embedding semantics in the embedding representation, and node embedding semantics with higher semantic expression quality are purified to replace original nodes. Then, SQL code semantic coding based on a tree-shaped long-short-term memory network is carried out on the semantic embedded representation of the abstract syntax tree subjected to filtering and purification processing, so that accurate recognition and detection of SQL injection vulnerabilities are achieved by enhancing the structured dependency relationship among words in SQL instruction codes. Therefore, intrusion protection response data processing can be performed more intelligently, and automatic identification and detection of SQL injection attacks are facilitated, so that the problem of horse hanging is solved from the source, and the security of a website is enhanced.

The invention discloses a transaction management method and server based on dynamic SQL (Structured Query Language) processing, and the method comprises the steps: determining a to-be-executed business process in response to a received API (Application Program Interface) request of a user terminal; decomposing the business process to be executed into a plurality of process nodes; identifying a transaction node group in each process node, and declaring a joint transaction for all the transaction node groups; for each transaction node, obtaining a corresponding target SQL statement, and dynamically modifying the target SQL statement; executing the dynamically modified target SQL statement, and packaging the dynamically modified target SQL statement into a transaction operation unit under the condition that the dynamically modified target SQL statement belongs to the joint transaction; executing all the encapsulated transaction operation units, and submitting or rolling back the joint transaction to obtain an execution result; and returning an execution result to the user terminal. According to the method and the device, the problems of difficulty in dynamic SQL construction, SQL injection risk and poor maintainability can be effectively solved.

The invention relates to the field of gateway verification, in particular to a security authentication gateway system and method based on AI analysis, and the system comprises a log verification module, an AI analysis module, a solid-state hardware module, a quantitative decoding module and a condition latching module, the AI analysis module is used for positioning a target subnet and generating a signature function, the solid-state hardware module is used for constructing a physical communication link of the gateway, the quantization decoding module is used for confirming receiving and transmitting time and decoding data, and the condition latch module is used for processing response signals and adjusting data packet receiving and transmitting time. According to the method, the influence of attack modes such as malicious traffic, DDoS attack and SQL injection on gateway communication is prevented, and meanwhile, the communication speed of network communication is improved, so that the security and flexibility of the security verification gateway are ensured, and the network management cost is reduced.

The invention provides an SQL (Structured Query Language) attack false alarm elimination method, which comprises the following steps of: logging in network security equipment to extract alarm information, screening alarms related to WEB service SQL injection attacks from the alarm information, and forming an SQL injection alarm list S; and for each alarm in the SQL injection alarm list S, downloading a data packet related to the alarm, and extracting feature information: based on the extracted feature information, carrying out false alarm analysis and judgment on each alarm to obtain a comprehensive judgment score, calculating a final score according to the comprehensive judgment score and the output of the machine learning model, and sending the final score to the server. And comparing the final score with a dynamic threshold value Threshold, and judging whether a false alarm exists or not. Through the SQL attack false alarm elimination method provided by the invention, the problem caused by SQL attack false alarm in related technologies is solved, the elimination method is faster, the accuracy is higher, and the SQL attack false alarm problem can be more effectively solved.

The invention discloses a database risk detection method and device, a storage medium and a terminal. In response to a database risk detection request triggered for the target access request, extracting a to-be-detected attack statement in the target access request through the large language model, and generating a to-be-detected vector of the to-be-detected attack statement; a target vector meeting a preset similar condition with the to-be-detected vector is inquired in a vector database, a target attack statement corresponding to the target vector is determined, and at least one vector corresponding to an attack statement used for executing the SQL injection attack is stored in the vector database; and outputting a query result corresponding to the target access request, wherein the query result comprises the target attack statement. When the detection request is triggered, the large language model extracts the to-be-detected attack statement, then the to-be-detected attack statement is vectorized through the vector model to generate the to-be-detected vector, the to-be-detected vector is compared with the vector corresponding to the attack statement in the database, and the result is obtained, so that the risk detection cost is reduced, and the detection accuracy is ensured.

The invention discloses an SQL (Structured Query Language) injection detection method and system based on a grammar and semantic feature fusion network and a storage medium. The method comprises the following steps of collecting a plurality of SQL injection samples as training data and preprocessing the training data; training a detection model by using the preprocessed training data, extracting semantic features of SQL statements of the training data by the detection model by using a BERT model, automatically extracting grammatical features by means of ChatGPT through a prompt project, and performing weighted fusion on the grammatical features by using a cross attention mechanism; and receiving to-be-detected traffic data, inputting the to-be-detected traffic data into the trained detection model for processing, and detecting the SQL injection attack in the to-be-detected traffic data. According to the method, the problem that a traditional SQL injection attack detection method is insufficient in capability of detecting novel and complex SQL injection attacks is solved, and the accuracy and efficiency of SQL injection attack detection are remarkably improved.

The embodiment of the invention provides an SQL injection attack protection method and device based on a zero-trust framework, and the method comprises the steps: tracking a current operation behavior of operation data in a zero-trust network, and determining whether the current operation behavior belongs to a to-be-verified behavior in the zero-trust network; if yes, calling a pre-trained linear support vector classifier (LSVC) model to detect the current operation behavior; if the detection result is the SQL injection attack, refusing the current operation behavior; wherein the pre-trained LSVC model is a model obtained by training according to a training data set, and the training data set comprises data of a plurality of malicious SQL injection attacks and normal data. The method provided by the embodiment of the invention solves the problems that the user experience is reduced and the management cost of an administrator is increased due to limitation of user input in the prior art.

The invention relates to an intelligent question counting method and device, electronic equipment and a storage medium, and belongs to the technical field of intelligent questions.The method comprises the steps that a query text input by a user and an MCP tool list are obtained; each MCP tool in the MCP tool list is constructed according to the interface description information of each back-end service interface; determining a query intention of the query text through the large language model, and determining a target MCP tool from the MCP tool list according to the query intention; calling a target service interface through the target MCP tool to obtain answer information from a rear end; and generating an answer text according to the answer information. The tedious question and answer pair configuration operation can be saved, the SQL injection risk is avoided, and better query flexibility is achieved.

The invention discloses an SQL (Structured Query Language) injection vulnerability detection method and device, electronic equipment and a storage medium. The method comprises the steps that data input points and test data of a to-be-detected application program are determined, the test data are character strings of SQL symbols, and the SQL symbols are determined based on SQL statements associated with the data input points; test data is input to the data input point, an execution result of a test statement generated based on the application program is obtained, and the test statement is determined based on the test statement and an SQL statement corresponding to the data input point; and comparing preset reference information with the execution result of the test statement, and determining that the SQL injection vulnerability exists in the SQL statement corresponding to the data input point under the condition that the preset reference information is matched with the execution result. By utilizing the embodiment of the invention, the vulnerability detection efficiency and the vulnerability detection accuracy can be effectively improved, and the normal use of the application program by the user is not easily interfered.

The invention discloses an SQL injection detection method and device, equipment and a storage medium, and relates to the technical field of safety protection, and the method comprises the steps: obtaining an initial SQL statement input by a target user through a target Web application, and carrying out the preprocessing of the initial SQL statement, so as to obtain a corresponding target SQL statement; generating a corresponding token sequence based on the target SQL statement, and constructing a target abstract syntax tree corresponding to the target SQL statement; wherein the token sequence is a sequence generated based on each SQL element in the target SQL statement; and extracting a target feature corresponding to the target SQL statement based on the token sequence and the target abstract syntax tree, and detecting whether the target SQL statement has an injection attack behavior based on the target feature by using a pre-trained target graph neural network model. According to the method, high-accuracy, high-adaptability and low-delay SQL injection real-time detection can be realized.

The invention relates to the technical field of network security, in particular to an injection attack detection method based on multi-dimensional feature fusion and time optimization. The detection method comprises the following steps: acquiring character-level features and sub-word-level features of an HTTP request in a two-channel input mode; extracting multi-layer semantic information of the features by using a pre-training model; carrying out fusion processing on the features of different levels through a multi-dimensional feature fusion module; performing weight optimization on the fused features by using an adaptive feature attention module; applying a multi-scale cavity pooling module to extract multi-scale features; and performing time optimization on the model structure based on neural architecture search. According to the method, the detection accuracy of the Web application firewall on attacks such as SQL injection, XSS injection and RCE injection can be effectively improved, meanwhile, the real-time performance of the model is guaranteed, and the method is suitable for security protection in a high-concurrency Web application environment.

The invention discloses an SQL (Structured Query Language) injection attack detection method and system and related equipment, and relates to a network information security technology. The method comprises the steps that multiple collected SQL injection samples serve as training data to be preprocessed; performing three-stage training on the security big model by using the preprocessed training data; the first stage is to perform unsupervised pre-training by using the preprocessed training data, the second stage is to perform first fine tuning by using a Mixture of Experts architecture and a multi-task head form, and the third stage is to perform second fine tuning by using a comparative learning method; and receiving the to-be-detected traffic data, inputting the to-be-detected traffic data into the trained security detection large model, and detecting the SQL injection attack in the to-be-detected traffic data, thereby solving the technical problems that a traditional SQL injection attack detection method has obvious detection capability and insufficient flexibility for complex and changeable advanced SQL injection attacks, and improving the detection efficiency. The technical effect of remarkably improving the accuracy and efficiency of SQL injection attack detection is achieved.

The invention discloses an SQL (Structured Query Language) injection attack detection method and system and related equipment, and relates to a network information security technology. The method comprises the steps that multiple collected SQL injection samples serve as training data to be preprocessed; performing three-stage training on the security big model by using the preprocessed training data; the first stage is to perform unsupervised pre-training by using the preprocessed training data, the second stage is to perform first fine tuning by using a Mixture of Experts architecture and a multi-task head form, and the third stage is to perform second fine tuning by using a comparative learning method; and receiving the to-be-detected traffic data, inputting the to-be-detected traffic data into the trained security detection large model, and detecting the SQL injection attack in the to-be-detected traffic data, thereby solving the technical problems that a traditional SQL injection attack detection method has obvious detection capability and insufficient flexibility for complex and changeable advanced SQL injection attacks, and improving the detection efficiency. The technical effect of remarkably improving the accuracy and efficiency of SQL injection attack detection is achieved.

This invention proposes an intelligent method for detecting abnormal network behavior, including acquiring target network traffic data, constructing a multi-dimensional feature fusion model based on an attention mechanism, and building an abnormal behavior classification model based on deep learning. By automatically allocating attention to different network traffic features through the attention mechanism, it solves the problems of unreasonable feature weight allocation and insufficient feature fusion in traditional methods, significantly improving the detection capability for low-frequency and covert abnormal behaviors and effectively reducing false positive and false negative rates. The classification model employs a hybrid CNN and LSTM structure, taking into account both the local spatial and temporal features of network traffic, and can accurately identify various types of abnormal network behaviors such as DDoS attacks, port scanning, SQL injection, and malicious code propagation, adapting to diverse attack scenarios with high classification accuracy.

The invention discloses an SQL injection and storage type XSS detection defense system and method. The method specifically comprises the steps that S1, static analysis is conducted, wherein Web application source codes are scanned, SQL statements in the source codes are positioned, and header identifiers HT and variable identifiers VT in the SQL statements and operation identifiers AT participating in arithmetic or function operation expressions in the SQL statements are recognized and added; s2, dynamic detection and defense: analyzing an identifier added for an SQL statement, executing pre-calculation processing on an operation expression with an operation identifier AT, and identifying SQL injection and storage type XSS attacks caused by the operation expression; defending when an attack is detected; and S3, removing the identifier in the SQL after defense is completed, recovering the SQL statement to a standard SQL statement, and submitting the SQL statement to a database for execution. According to the method, accurate detection and defense are carried out on the SQL statement containing the arithmetic or function operation expression, the detection accuracy is improved, and the false alarm rate is reduced.

The invention belongs to the technical field of network security protection, and discloses a malicious behavior bypass interception system based on flow analysis and detection, a rule engine quickly matches known attacks based on a dynamic feature library, such as SQL injection, common port scanning, federated learning model combined multi-node cooperative training, and flow time, behavior and content features are combined to realize the flow analysis and detection of malicious behaviors. Unknown threats such as 0day vulnerability variants and low-frequency hidden attacks are accurately captured; in an enterprise mixed service traffic environment, missed judgment of traditional static detection on unknown attacks can be avoided, false alarms caused by data limitation of a single model can be reduced, energy consumption of operation and maintenance personnel for processing invalid alarms is reduced, core assets are prevented from being damaged by novel attacks, and comprehensiveness and reliability of network protection are remarkably improved; a bypass deployment mode is adopted, traffic is obtained through network TAP equipment or traffic mirror images, a service main forwarding link does not need to be intervened, and network delay and single-point failure risks introduced by traditional series deployment are avoided.

The application discloses a database auditing system SQL injection detection method based on syntax tree comparison, and sequentially carries out SQL statement preprocessing, constructs a benchmark syntax tree, constructs a malicious syntax tree, compares and analyzes the benchmark syntax tree and the malicious syntax tree, judges attacks on the SQL statement corresponding to the malicious syntax tree, and carries out different early warning operations and generates a report according to the attack judgment. The SQL injection detection method can refine the detection level of SQL injection, carries out different operations on different SQL injection behaviors, prevents resource waste, has more resources for system defense, and improves the defense capability of the system.

The invention discloses an SQL (Structured Query Language) injection feature extraction method and system and a medium, and the method comprises the steps: initializing an original load feature vector, and inputting and traversing an original load data set; reading an original load, and defining a feature group as an SQL injection feature vector; basic scale features, grammar construction features, grammar interpretation features, complexity features, comprehensive description features and character separation features in the feature group are extracted in sequence; constructing a feature matrix, and outputting a standardized feature matrix; according to the method, the appropriate SQL injection features are selected, the stability and reliability of feature extraction are improved, the accuracy of machine learning model training is improved, the SQL injection detection effect is further improved, meanwhile, the calculation cost is reduced, and the method can be suitable for large-scale and high-speed network application scenes.

The present invention provides a web application protection method, system, and computer-readable storage medium. The method comprises: a front-end sending a data request to a back-end, the data request carrying a uniform resource locator (URL) and parameter information; upon receiving the data request, the back-end parsing the parameter information to obtain corresponding parameter values; and the back-end generating corresponding parameter images based on the parameter values, and saving the parameter images to a preset database. By graphically representing parameter values, the present invention can avoid web application risks caused by inserting malicious code into parameters, effectively defend against attacks such as cross-site scripting, SQL injection, file uploads, and brute force attacks, thereby improving the security of web applications and achieving comprehensive protection for web applications. This addresses the problem that existing web application protection methods lack comprehensive protection for web applications.

The present application discloses an AI-based intrusion protection response data processing method and server, which can collect the code of SQL instructions and analyze the code of the SQL instructions using data processing and semantic understanding algorithms based on artificial intelligence and deep learning, so as to capture and depict the abstract syntax tree semantic embedding representation of the SQL instruction code, and filter based on the correlation information between the embedded semantics of each node in the embedded representation, so as to purify the node embedded semantics with higher semantic expression quality to replace the original node. Then, the SQL code semantic encoding based on the tree-shaped long short-term memory network is performed on the abstract syntax tree semantic embedding representation after filtering and purification, so as to utilize the structured dependency relationship between each word in the enhanced SQL instruction code to achieve accurate identification and detection of SQL injection vulnerabilities. In this way, intrusion protection response data processing can be performed more intelligently, helping to automatically identify and detect SQL injection attacks, so as to solve the problem of Trojans from the source and enhance the security of the website.

The invention provides a non-invasive sql injection detection method and device and a storage medium. The method comprises the following steps: acquiring a plurality of code packets of a server, and acquiring Class objects of the code packets according to packet names of the code packets; a preset sql injection verification rule is obtained, the preset sql injection verification rule is packaged, an sql injection verification annotation is obtained, the sql injection verification annotation is labeled on a preset field, an annotation labeling field is obtained, the preset field is a field with the sql injection risk, and the preset sql injection verification rule is a keyword and a character rule for splicing and constructing a payload; and binding the annotation labeling field with the corresponding Class object to obtain a verification object, obtaining an input request of the client, and verifying the input request by adopting the verification object. The method solves the problem that existing function codes need to be modified in an sql injection defense method in the prior art.

This invention discloses a method, apparatus, device, and storage medium for detecting SQL injection attacks. The method includes the following steps: based on an abstract syntax tree generated by parsing a received SQL statement, semantically and syntactically encoding the nodes in the abstract syntax tree to obtain semantic feature vectors and syntactic feature vectors for each node; concatenating and fusing the semantic feature vectors and syntactic feature vectors to generate initial features for each node; based on a constructed sparse heterogeneous graph, using a graph convolutional network to propagate the initial features between each node and its neighboring nodes to obtain updated features for each node; performing global average pooling on the updated features of the nodes to obtain a global representation vector of the SQL statement, and inputting the global representation vector into a classifier to output the SQL injection detection result. This application can significantly reduce the computational resource requirements of the model while maintaining high detection accuracy.

The application discloses a SQL injection interception and illegal user identification method based on differential testing, which comprises the following steps: firstly, constructing a message information set containing SQL injection, and building an illegal user information record database; secondly, obtaining the IP address of each message information in the message information set, and inputting the IP address as a keyword into the illegal user information record database for interception discrimination; then, obtaining the keyword information of a target field in the message information which has not been intercepted, and performing differential testing on the keyword information; finally, screening the keyword information and user information such as the IP address in the differential testing case which does not pass, and storing the keyword information and user information into the illegal user information record database, so that the user is an illegal user. The application can actively intercept and record illegal operations of illegal users, effectively reduce the false negative rate, improve the interception rate, and improve the work efficiency of network security maintenance personnel.

This application discloses a method, computer device, and readable storage medium for determining SQL injection vulnerabilities in source code, belonging to the field of source code security detection technology. The method includes the following steps: responding to an SQL injection detection command in the source code, generating a set of legal input parameters based on a legal input scenario corresponding to the source code, and generating a set of test input parameters based on an injection statement library; wherein the injection statement library includes multiple injection statement templates; based on the set of legal input parameters and the source code, collecting first execution data through code instrumentation; based on the set of test input parameters and the source code, collecting second execution data through code instrumentation; and determining SQL injection vulnerabilities in the source code based on the first execution data and the second execution data. This application can reduce the false positive rate of SQL injection vulnerability detection and improve the targeting of SQL injection vulnerability detection.

The application discloses a kind of based on search enhancement SQL injection counter sample generation method, belong to traffic analysis and network security technical field.The application is divided into two links, first collect multiple sets of public traffic data set extraction SQL injection load, generate counter sample by a variety of variation mode, after structured cleaning, vectorization process builds SQL injection counter sample knowledge base.Second, rely on search enhancement generation technology, search similar sample and variation strategy in knowledge base, guide large language model iteration generates new counter sample, and effective sample is supplemented to knowledge base.Finally, normal traffic, original malicious sample and new counter sample are fused to construct training set, and the adversarial training of traffic detection model is completed.The application can improve the diversity and generation efficiency of counter sample, effectively strengthen the recognition ability and overall robustness of detection model to SQL injection variation attack.

The invention discloses a structured query statement injection attack identification method and device. The method comprises the steps of obtaining a to-be-recognized structured query statement; a first feature value corresponding to the to-be-recognized structured query statement is determined, and the first feature value is used for quantitatively representing a grammatical structure and a logic relation of the to-be-recognized structured query statement; the difference degree between the first feature value and a second feature value of a candidate template is determined, the candidate template comprises a sample structured query statement matched with the operation type of the to-be-recognized structured query statement, and the difference degree is used for quantitatively representing the structural similarity degree between the to-be-recognized structured query statement and the candidate template; and determining an identification result of the to-be-identified structured query statement according to the difference degree. According to the method and the device, the technical problem of low detection accuracy caused by matching based on a known attack feature code in an SQL injection detection method adopted in related technologies is solved.

The invention discloses a method for discovering SQL injection attack behaviors based on chaotic parting dimensions, and the method specifically comprises the steps: S1, data collection and feature extraction: obtaining HTTP request data, including SQL query data; extracting the characteristics of the SQL injection attack, wherein the characteristics comprise special characters, SQL keywords and potential malicious structures; s2, calculating a parting dimension; s3, setting a classification dimension threshold value, and if the classification dimension of the selected SQL statement is higher than the threshold value, judging that the SQL statement is an SQL injection attack; and S4, performing anomaly detection and response. The invention mainly relates to the technical field of network security, chaos theory and typing analysis. According to the method, the data is analyzed by using the typing dimension in the chaos theory, the accuracy and efficiency of attack detection are further improved, and nonlinear characteristics and complexity in an attack mode can be revealed, so that the method has advantages in coping with complex attacks.

This application provides a method and apparatus for testing server-side vulnerabilities in web applications. It effectively uncovers potential vulnerabilities through intelligent analysis and feedback mechanisms. By parsing web application pages, extracting key elements, and deriving field matching rules based on server feedback, it generates semantic input samples that conform to the application logic. By comparing historical execution paths, it automatically discovers new paths and further explores potential deep-seated vulnerabilities through mutation operations. This method not only improves test coverage and depth but also dynamically optimizes test samples based on actual feedback, avoiding the blindness and inefficiency of traditional testing methods. This solution can effectively identify various security vulnerabilities in web applications, such as SQL injection and XSS attacks, enhancing the security and reliability of web applications and providing developers with more accurate and efficient vulnerability detection methods.

The embodiment of the invention discloses an SQL (Structured Query Language) injection detection method, which comprises the following steps of: scanning an SQL statement word by word through a preset finite state automaton to obtain a machine lexical type of each lexical unit, constructing a lexical unit queue of the SQL statement on the basis of characters and lexical types of lexical units, and detecting the SQL (Structured Query Language). And obtaining a detection result through a pre-trained detection model for risk control. According to the method, an SQL statement is split through a state transition strategy of a finite state automaton to obtain lexical units, the problem that a regular matching mode cannot adapt to rapidly-changing attacks is avoided, meanwhile, due to the SQL injection principle, the mode for determining the lexical units and the types of the lexical units can effectively recognize zero-day attacks, and therefore the zero-day attacks can be effectively recognized. And the detection accuracy and efficiency of SQL injection are greatly improved.

The invention discloses an SQL classification method and system based on a standardized Born network and a model training method and system, and belongs to the technical field of network security. The method comprises the steps that feature vectors of SQL statements and corresponding real tags are obtained, and the feature vectors are mapped to a non-negative region and normalized; the feature vectors of the SQL statements serve as input of a regularization Born network model, labels of the SQL statements serve as classification results of the regularization Born network model, the regularization Born network model is trained, the trained regularization Born network model calculates the collapse probability of conversion from a wave function of a superposition state of the feature vectors to a quantum state, and the collapse probability of conversion from the wave function to the quantum state is calculated. Classifying the SQL statements according to the collapse probability; according to the method, the Born theory is used for researching SQL injection, and the detection accuracy and the detection efficiency of the SQL are remarkably improved.