45 results about "SQL injection" patented technology

The invention discloses an SQL injection detection method and device, equipment and a storage medium, and relates to the technical field of safety protection, and the method comprises the steps: obtaining an initial SQL statement input by a target user through a target Web application, and carrying out the preprocessing of the initial SQL statement, so as to obtain a corresponding target SQL statement; generating a corresponding token sequence based on the target SQL statement, and constructing a target abstract syntax tree corresponding to the target SQL statement; wherein the token sequence is a sequence generated based on each SQL element in the target SQL statement; and extracting a target feature corresponding to the target SQL statement based on the token sequence and the target abstract syntax tree, and detecting whether the target SQL statement has an injection attack behavior based on the target feature by using a pre-trained target graph neural network model. According to the method, high-accuracy, high-adaptability and low-delay SQL injection real-time detection can be realized.

This invention proposes an intelligent method for detecting abnormal network behavior, including acquiring target network traffic data, constructing a multi-dimensional feature fusion model based on an attention mechanism, and building an abnormal behavior classification model based on deep learning. By automatically allocating attention to different network traffic features through the attention mechanism, it solves the problems of unreasonable feature weight allocation and insufficient feature fusion in traditional methods, significantly improving the detection capability for low-frequency and covert abnormal behaviors and effectively reducing false positive and false negative rates. The classification model employs a hybrid CNN and LSTM structure, taking into account both the local spatial and temporal features of network traffic, and can accurately identify various types of abnormal network behaviors such as DDoS attacks, port scanning, SQL injection, and malicious code propagation, adapting to diverse attack scenarios with high classification accuracy.

The invention discloses an SQL injection and storage type XSS detection defense system and method. The method specifically comprises the steps that S1, static analysis is conducted, wherein Web application source codes are scanned, SQL statements in the source codes are positioned, and header identifiers HT and variable identifiers VT in the SQL statements and operation identifiers AT participating in arithmetic or function operation expressions in the SQL statements are recognized and added; s2, dynamic detection and defense: analyzing an identifier added for an SQL statement, executing pre-calculation processing on an operation expression with an operation identifier AT, and identifying SQL injection and storage type XSS attacks caused by the operation expression; defending when an attack is detected; and S3, removing the identifier in the SQL after defense is completed, recovering the SQL statement to a standard SQL statement, and submitting the SQL statement to a database for execution. According to the method, accurate detection and defense are carried out on the SQL statement containing the arithmetic or function operation expression, the detection accuracy is improved, and the false alarm rate is reduced.

The invention belongs to the technical field of network security protection, and discloses a malicious behavior bypass interception system based on flow analysis and detection, a rule engine quickly matches known attacks based on a dynamic feature library, such as SQL injection, common port scanning, federated learning model combined multi-node cooperative training, and flow time, behavior and content features are combined to realize the flow analysis and detection of malicious behaviors. Unknown threats such as 0day vulnerability variants and low-frequency hidden attacks are accurately captured; in an enterprise mixed service traffic environment, missed judgment of traditional static detection on unknown attacks can be avoided, false alarms caused by data limitation of a single model can be reduced, energy consumption of operation and maintenance personnel for processing invalid alarms is reduced, core assets are prevented from being damaged by novel attacks, and comprehensiveness and reliability of network protection are remarkably improved; a bypass deployment mode is adopted, traffic is obtained through network TAP equipment or traffic mirror images, a service main forwarding link does not need to be intervened, and network delay and single-point failure risks introduced by traditional series deployment are avoided.

The application discloses a database auditing system SQL injection detection method based on syntax tree comparison, and sequentially carries out SQL statement preprocessing, constructs a benchmark syntax tree, constructs a malicious syntax tree, compares and analyzes the benchmark syntax tree and the malicious syntax tree, judges attacks on the SQL statement corresponding to the malicious syntax tree, and carries out different early warning operations and generates a report according to the attack judgment. The SQL injection detection method can refine the detection level of SQL injection, carries out different operations on different SQL injection behaviors, prevents resource waste, has more resources for system defense, and improves the defense capability of the system.

The invention discloses an SQL (Structured Query Language) injection feature extraction method and system and a medium, and the method comprises the steps: initializing an original load feature vector, and inputting and traversing an original load data set; reading an original load, and defining a feature group as an SQL injection feature vector; basic scale features, grammar construction features, grammar interpretation features, complexity features, comprehensive description features and character separation features in the feature group are extracted in sequence; constructing a feature matrix, and outputting a standardized feature matrix; according to the method, the appropriate SQL injection features are selected, the stability and reliability of feature extraction are improved, the accuracy of machine learning model training is improved, the SQL injection detection effect is further improved, meanwhile, the calculation cost is reduced, and the method can be suitable for large-scale and high-speed network application scenes.

This invention discloses a method, apparatus, device, and storage medium for detecting SQL injection attacks. The method includes the following steps: based on an abstract syntax tree generated by parsing a received SQL statement, semantically and syntactically encoding the nodes in the abstract syntax tree to obtain semantic feature vectors and syntactic feature vectors for each node; concatenating and fusing the semantic feature vectors and syntactic feature vectors to generate initial features for each node; based on a constructed sparse heterogeneous graph, using a graph convolutional network to propagate the initial features between each node and its neighboring nodes to obtain updated features for each node; performing global average pooling on the updated features of the nodes to obtain a global representation vector of the SQL statement, and inputting the global representation vector into a classifier to output the SQL injection detection result. This application can significantly reduce the computational resource requirements of the model while maintaining high detection accuracy.

The application discloses a SQL injection interception and illegal user identification method based on differential testing, which comprises the following steps: firstly, constructing a message information set containing SQL injection, and building an illegal user information record database; secondly, obtaining the IP address of each message information in the message information set, and inputting the IP address as a keyword into the illegal user information record database for interception discrimination; then, obtaining the keyword information of a target field in the message information which has not been intercepted, and performing differential testing on the keyword information; finally, screening the keyword information and user information such as the IP address in the differential testing case which does not pass, and storing the keyword information and user information into the illegal user information record database, so that the user is an illegal user. The application can actively intercept and record illegal operations of illegal users, effectively reduce the false negative rate, improve the interception rate, and improve the work efficiency of network security maintenance personnel.

This application discloses a method, computer device, and readable storage medium for determining SQL injection vulnerabilities in source code, belonging to the field of source code security detection technology. The method includes the following steps: responding to an SQL injection detection command in the source code, generating a set of legal input parameters based on a legal input scenario corresponding to the source code, and generating a set of test input parameters based on an injection statement library; wherein the injection statement library includes multiple injection statement templates; based on the set of legal input parameters and the source code, collecting first execution data through code instrumentation; based on the set of test input parameters and the source code, collecting second execution data through code instrumentation; and determining SQL injection vulnerabilities in the source code based on the first execution data and the second execution data. This application can reduce the false positive rate of SQL injection vulnerability detection and improve the targeting of SQL injection vulnerability detection.

The application discloses a kind of based on search enhancement SQL injection counter sample generation method, belong to traffic analysis and network security technical field.The application is divided into two links, first collect multiple sets of public traffic data set extraction SQL injection load, generate counter sample by a variety of variation mode, after structured cleaning, vectorization process builds SQL injection counter sample knowledge base.Second, rely on search enhancement generation technology, search similar sample and variation strategy in knowledge base, guide large language model iteration generates new counter sample, and effective sample is supplemented to knowledge base.Finally, normal traffic, original malicious sample and new counter sample are fused to construct training set, and the adversarial training of traffic detection model is completed.The application can improve the diversity and generation efficiency of counter sample, effectively strengthen the recognition ability and overall robustness of detection model to SQL injection variation attack.

The invention discloses a structured query statement injection attack identification method and device. The method comprises the steps of obtaining a to-be-recognized structured query statement; a first feature value corresponding to the to-be-recognized structured query statement is determined, and the first feature value is used for quantitatively representing a grammatical structure and a logic relation of the to-be-recognized structured query statement; the difference degree between the first feature value and a second feature value of a candidate template is determined, the candidate template comprises a sample structured query statement matched with the operation type of the to-be-recognized structured query statement, and the difference degree is used for quantitatively representing the structural similarity degree between the to-be-recognized structured query statement and the candidate template; and determining an identification result of the to-be-identified structured query statement according to the difference degree. According to the method and the device, the technical problem of low detection accuracy caused by matching based on a known attack feature code in an SQL injection detection method adopted in related technologies is solved.

The invention discloses a method for discovering SQL injection attack behaviors based on chaotic parting dimensions, and the method specifically comprises the steps: S1, data collection and feature extraction: obtaining HTTP request data, including SQL query data; extracting the characteristics of the SQL injection attack, wherein the characteristics comprise special characters, SQL keywords and potential malicious structures; s2, calculating a parting dimension; s3, setting a classification dimension threshold value, and if the classification dimension of the selected SQL statement is higher than the threshold value, judging that the SQL statement is an SQL injection attack; and S4, performing anomaly detection and response. The invention mainly relates to the technical field of network security, chaos theory and typing analysis. According to the method, the data is analyzed by using the typing dimension in the chaos theory, the accuracy and efficiency of attack detection are further improved, and nonlinear characteristics and complexity in an attack mode can be revealed, so that the method has advantages in coping with complex attacks.

This application provides a method and apparatus for testing server-side vulnerabilities in web applications. It effectively uncovers potential vulnerabilities through intelligent analysis and feedback mechanisms. By parsing web application pages, extracting key elements, and deriving field matching rules based on server feedback, it generates semantic input samples that conform to the application logic. By comparing historical execution paths, it automatically discovers new paths and further explores potential deep-seated vulnerabilities through mutation operations. This method not only improves test coverage and depth but also dynamically optimizes test samples based on actual feedback, avoiding the blindness and inefficiency of traditional testing methods. This solution can effectively identify various security vulnerabilities in web applications, such as SQL injection and XSS attacks, enhancing the security and reliability of web applications and providing developers with more accurate and efficient vulnerability detection methods.

The embodiment of the invention discloses an SQL (Structured Query Language) injection detection method, which comprises the following steps of: scanning an SQL statement word by word through a preset finite state automaton to obtain a machine lexical type of each lexical unit, constructing a lexical unit queue of the SQL statement on the basis of characters and lexical types of lexical units, and detecting the SQL (Structured Query Language). And obtaining a detection result through a pre-trained detection model for risk control. According to the method, an SQL statement is split through a state transition strategy of a finite state automaton to obtain lexical units, the problem that a regular matching mode cannot adapt to rapidly-changing attacks is avoided, meanwhile, due to the SQL injection principle, the mode for determining the lexical units and the types of the lexical units can effectively recognize zero-day attacks, and therefore the zero-day attacks can be effectively recognized. And the detection accuracy and efficiency of SQL injection are greatly improved.

The embodiment of the invention relates to the field of data processing, and provides an industrial sensitive data-oriented SQL injection response method, which comprises the following steps of: performing feature extraction on an SQL command uploaded by a client to obtain a first feature information set; calculating reasoning score information of an SQL command uploaded by a client according to first feature information in the first feature information set to obtain target score information; generating an injection response scheme corresponding to the SQL command uploaded by the client according to a preset score information threshold and the target score information to obtain a target response scheme; responding to an SQL command uploaded by the client according to the target response scheme to obtain a response result; the accuracy of performing injection response on the SQL uploaded by the client is improved.

The application provides a network request risk detection method, system and server, and relates to the field of network request risk detection. The method performs feature fusion on an injection keyword matching result, a network request parameter statistical result and a network request character vectorization result corresponding to to-be-detected data, dynamically optimizes continuous features in the fused feature data, and realizes accurate detection of SQL injection risks in a network request process through a lightweight classifier.

The invention relates to the technical field of computers, in particular to a network security data processing method and device. The method comprises the steps of obtaining current network security data; wherein the current network security data comprises network layer flow data, an application layer log and terminal equipment state data; performing feature extraction on the current network security data to obtain a current network security feature vector; inputting the current network security feature vector into a preset network security event detection model to obtain a current network security event; the current network security event comprises a DDoS attack event, an SQL injection event, a malicious code intrusion event and a data leakage event; according to the invention, based on the current network security event, security early warning of the current network is carried out, so that early warning can be carried out on the network security event more accurately.

This application relates to the fields of IT and software development technology, and provides a method, apparatus, device, and storage medium for generating SQL to prevent injection attacks. The method includes: determining a target mapping file and query conditions; determining a parent class in the target mapping file based on the query conditions; rewriting a preset query method in the parent class; converting all sorting associated with the preset query method in the target mapping file into a `setSort` sorting method of a preset sorting utility class; and sorting the target mapping file using the `setSort` sorting method to generate the final SQL to prevent injection attacks. The SQL generation method for preventing injection attacks provided in this application solves the SQL injection attack problem by uniformly converting the original query methods in the system into `setSort` sorting methods, generating the final SQL to prevent injection attacks with only minor modifications to the original sorting code.

The invention discloses a business data isolation method and device, electronic equipment and a storage medium, and relates to the technical field of data processing.According to the business data isolation method and device, the tenant identification serves as the core, access permission is analyzed and verified to intercept illegal requests, and the SQL injection risk is completely eradicated; a database operation request is switched to a tenant exclusive database instance through a dynamic data source routing engine, and tenant data physical isolation is achieved in cooperation with a dynamically mounted independent storage partition; meanwhile, unified resource scheduling is guaranteed through unvarnished transmission of the context of the tenants, and the completely centralized performance problem and the completely distributed redundancy defect are avoided; the technical effects of guaranteeing tenant data physical isolation and safety, avoiding SQL injection risks, improving system performance stability in a thousand-level tenant scene, reducing deployment redundancy, unifying data standards, improving resource utilization rate and adapting to insurance industry multi-tenant business management requirements are achieved.

The embodiment of the invention discloses a method, device and equipment for determining the resistance capability of a firewall and a storage medium. The method comprises the following steps: acquiring a rule of a Web application firewall connected with a Web server; determining a structured query language (SQL) statement in the Web server; and determining whether the Web application firewall has the capability of resisting SQL injection or not based on the rule of the Web application firewall, the SQL statement, the lexical rule of the SQL and the grammatical rule of the SQL. According to the method and the device, on the basis of the rule of the Web application firewall and the SQL statement in the Web server, the defense capability of the Web application firewall is verified by utilizing the lexical rules of the SQL and the grammatical rules of the SQL, a violent test mode does not need to be adopted, the test efficiency is improved, and the cost is reduced.

This invention relates to the field of computer security and proposes an automated method for discovering Java Spring SQL / SSRF vulnerabilities based on parameter flow simulation. The method includes the following steps: S1, parsing the class files compiled from the source project in the JAR package to be discovered, traversing the class files in the JAR package, and extracting the input parameters of the Mapping methods under the Controller as the starting point for taint analysis, serving as the source of taint propagation; and performing vulnerability chain detection based on the method set S-1, the SQL injection vulnerability taint function set S-2, and the SSRF taint function set S-3 propagated step-by-step by the method parameters. This invention aims to improve the accuracy and coverage of existing static analysis tools in identifying SQL / SSRF vulnerabilities in the Java Spring framework, offering advantages such as high efficiency, accuracy, and high coverage.

The application discloses a SQL injection vulnerability detection method and device, electronic equipment and a storage medium. The method comprises the following steps: determining a data input point and test data of an application to be detected, wherein the test data is a string of SQL symbols, and the SQL symbols are determined based on a SQL statement associated with the data input point; inputting the test data to the data input point, and obtaining an execution result of a test statement generated based on the application, wherein the test statement is determined based on the test statement and a SQL statement corresponding to the data input point; comparing the execution result of the test statement with preset reference information, and determining that a SQL injection vulnerability exists in the SQL statement corresponding to the data input point in the case that the reference information matches the execution result. By using the application, the vulnerability detection efficiency and the accuracy of the vulnerability detection can be effectively improved, and the normal use of the application by a user is not easily disturbed.

This application discloses an SQL injection detection method, apparatus, electronic device, storage medium, and program product, belonging to the field of computer technology. The method includes: extracting target detection features corresponding to an SQL statement to be detected; obtaining clusters matching the target detection features from a Markov network, wherein the Markov network is constructed based on multiple initial detection features and logical rules defining the relationships between the initial detection features, the Markov network includes multiple clusters, each cluster consists of nodes satisfying the same logical rule, the weight of each cluster is the weight of the corresponding logical rule, each node corresponds to one initial detection feature, and each logical rule is used to characterize a group of high-risk node combinations; determining the risk probability corresponding to the SQL statement to be detected based on the matching clusters; and determining the injection detection result corresponding to the SQL statement to be detected based on the risk probability.

The application discloses a network security management and control method and system based on different scenes, and the method comprises the following steps: when the number of elements in a to-be-responded queue is less than a preset number, performing SQL injection detection on each request parameter based on a first interception rule to obtain an SQL injection detection result; when the number of elements in the to-be-responded queue reaches the preset number, simultaneously performing SQL injection detection on each request parameter based on a second interception rule to obtain an SQL injection detection result; and based on the SQL injection detection result obtained based on the first interception rule or the second interception rule and the request parameter to be responded, performing a corresponding response operation. The application can provide corresponding SQL injection detection schemes for different scenes, and can accelerate the response speed of a large number of SQL access requests in a short time.

The application discloses a SQL injection prediction model training method and system, a storage medium, and a SQL injection prediction model training method and system, and a storage medium, wherein a new SQL injection loss function is constructed, a SQL type balance factor, a SQL difficult sample focusing parameter and a smooth hinge loss are coupled, a first-order partial derivative and a second-order partial derivative of the loss function are calculated, the first-order partial derivative and the second-order partial derivative of the loss function are substituted into information gain, a decision tree structure is constructed, a decision tree model is trained, optimal SQL injection features and optimal split nodes are obtained, and an optimal decision tree structure and a corresponding SQL injection prediction model are constructed. The application can reduce the time complexity of model training, avoid overfitting or underfitting of the trained model, and improve the accuracy of machine learning SQL injection detection.

This invention presents a unified processing method for eight business processes in an industrial finished goods warehouse based on table-valued parameters, relating to the fields of industrial MES and database security technology. This method encapsulates all eight processes—normal inbound, normal outbound, other inbound, other outbound, and corresponding queries—into stored procedures, using table-valued parameters as unified input parameters and standard SQL to achieve cross-database compatibility. A fully enclosed security architecture prevents direct front-end access to data tables, eliminating SQL injection and unauthorized operations at the source. Layered business logic, strong transactions, and pre-validation ensure data consistency, achieving controllable, secure, and standardized unified management of all finished goods warehouse business processes. This invention is applicable to industrial scenarios such as metallurgy and manufacturing, and can run seamlessly in databases such as SQL Server and GaussDB, improving system security, stability, and maintainability. This invention has been fully implemented in a real industrial ERP system, can run stably in real production environments for a long time, and possesses mature engineering value and industrial promotion capabilities.

The invention discloses an SQL (Structured Query Language) injection detection method and system and a storage medium. The method comprises the following steps: analyzing HTTP flow of a Web request; extracting an SQL injection feature vector; constructing a decision tree ensemble learning training SQL injection prediction model, and optimizing training parameters through grid search to select an optimal model; and calling the optimal model, inputting the extracted SQL injection feature vector into the decision tree structure and the dichotomy condition probability in the model, and obtaining a prediction result. The SQL injection detection model is subjected to ensemble learning and trained through a self-defined decision tree, and the optimal model is optimized and selected through grid search, so that the fitting of the model is remarkably accelerated, and the detection capability of the model on variable and complex SQL injection attacks is greatly improved.

This invention discloses an SQL injection detection method and apparatus that integrates instantaneous behavioral features and long-term evolutionary features. The invention captures user requests and records metadata; associates user sessions through a multi-dimensional session identification strategy, constructs and updates a dynamic context model for each session in real time; extracts multi-dimensional feature vectors of requests, calculates static anomaly scores, and achieves high-risk instant attack determination; for non-high-risk requests, performs multi-scale analysis on the session temporal entropy spectrum sequence to obtain temporal anomaly scores; combines the dynamic context model to perform semantic consistency checks and correct the temporal anomaly scores; integrates the static anomaly scores, corrected temporal anomaly scores, and context factors to calculate a session risk score; determines session-level malicious attacks based on a dynamically adjusted adaptive session threshold, and executes a tiered response. This invention constructs a spatiotemporal collaborative detection framework of instantaneous static entropy analysis and session-level temporal entropy spectrum analysis, possessing both single-request deep semantic analysis and cross-request correlation detection capabilities.

The invention discloses an SQL (Structured Query Language) injection prediction model training method and system and a storage medium, and the method comprises the steps: constructing a new SQL injection loss function, coupling an SQL type balance factor, an SQL difficult sample focusing parameter and smooth hinge loss, and calculating to obtain a first-order partial derivative and a second-order partial derivative of the loss function; substituting the calculated first-order partial derivative and second-order partial derivative of the loss function into information gain; and constructing a decision tree structure, training a decision tree model to obtain an optimal SQL injection feature and an optimal split node, and constructing an optimal decision tree structure and a corresponding SQL injection prediction model. The time complexity of model training can be reduced, over-fitting or under-fitting of the trained model is avoided, and meanwhile, the accuracy of machine learning SQL injection detection is improved.

The invention discloses a vulnerability detection method and system for second-order SQL (Structured Query Language) injection, and belongs to the technical field of vulnerability detection. The method comprises the following steps: inputting a source code to be detected into a pre-constructed vulnerability detection model, and outputting a second-order SQL injection vulnerability detection result of the source code; wherein the processing steps of the vulnerability detection model comprise: identifying an SQL field of an SQL statement in a to-be-detected source code, and constructing an SQL field data item; key features of SQL field data items are extracted, and data item features are generated; performing taint analysis on the constructed control flow diagram and data flow diagram to generate a second-order SQL injection vulnerability data item group; the second-order SQL injection vulnerability data item group is converted into an SQL statement where the second-order SQL injection vulnerability data item group is located, and a test case sequence is generated; and executing the test case sequence to generate a second-order SQL injection vulnerability detection result of the source code. According to the method, the detection precision and efficiency of the second-order SQL injection attack are improved, and the Web application security protection capability is improved.