62 results about "SQL injection" patented technology

The invention discloses a transaction management method and server based on dynamic SQL (Structured Query Language) processing, and the method comprises the steps: determining a to-be-executed business process in response to a received API (Application Program Interface) request of a user terminal; decomposing the business process to be executed into a plurality of process nodes; identifying a transaction node group in each process node, and declaring a joint transaction for all the transaction node groups; for each transaction node, obtaining a corresponding target SQL statement, and dynamically modifying the target SQL statement; executing the dynamically modified target SQL statement, and packaging the dynamically modified target SQL statement into a transaction operation unit under the condition that the dynamically modified target SQL statement belongs to the joint transaction; executing all the encapsulated transaction operation units, and submitting or rolling back the joint transaction to obtain an execution result; and returning an execution result to the user terminal. According to the method and the device, the problems of difficulty in dynamic SQL construction, SQL injection risk and poor maintainability can be effectively solved.

The invention relates to an intelligent question counting method and device, electronic equipment and a storage medium, and belongs to the technical field of intelligent questions.The method comprises the steps that a query text input by a user and an MCP tool list are obtained; each MCP tool in the MCP tool list is constructed according to the interface description information of each back-end service interface; determining a query intention of the query text through the large language model, and determining a target MCP tool from the MCP tool list according to the query intention; calling a target service interface through the target MCP tool to obtain answer information from a rear end; and generating an answer text according to the answer information. The tedious question and answer pair configuration operation can be saved, the SQL injection risk is avoided, and better query flexibility is achieved.

The invention discloses an SQL injection detection method and device, equipment and a storage medium, and relates to the technical field of safety protection, and the method comprises the steps: obtaining an initial SQL statement input by a target user through a target Web application, and carrying out the preprocessing of the initial SQL statement, so as to obtain a corresponding target SQL statement; generating a corresponding token sequence based on the target SQL statement, and constructing a target abstract syntax tree corresponding to the target SQL statement; wherein the token sequence is a sequence generated based on each SQL element in the target SQL statement; and extracting a target feature corresponding to the target SQL statement based on the token sequence and the target abstract syntax tree, and detecting whether the target SQL statement has an injection attack behavior based on the target feature by using a pre-trained target graph neural network model. According to the method, high-accuracy, high-adaptability and low-delay SQL injection real-time detection can be realized.

The invention relates to the technical field of network security, in particular to an injection attack detection method based on multi-dimensional feature fusion and time optimization. The detection method comprises the following steps: acquiring character-level features and sub-word-level features of an HTTP request in a two-channel input mode; extracting multi-layer semantic information of the features by using a pre-training model; carrying out fusion processing on the features of different levels through a multi-dimensional feature fusion module; performing weight optimization on the fused features by using an adaptive feature attention module; applying a multi-scale cavity pooling module to extract multi-scale features; and performing time optimization on the model structure based on neural architecture search. According to the method, the detection accuracy of the Web application firewall on attacks such as SQL injection, XSS injection and RCE injection can be effectively improved, meanwhile, the real-time performance of the model is guaranteed, and the method is suitable for security protection in a high-concurrency Web application environment.

This invention proposes an intelligent method for detecting abnormal network behavior, including acquiring target network traffic data, constructing a multi-dimensional feature fusion model based on an attention mechanism, and building an abnormal behavior classification model based on deep learning. By automatically allocating attention to different network traffic features through the attention mechanism, it solves the problems of unreasonable feature weight allocation and insufficient feature fusion in traditional methods, significantly improving the detection capability for low-frequency and covert abnormal behaviors and effectively reducing false positive and false negative rates. The classification model employs a hybrid CNN and LSTM structure, taking into account both the local spatial and temporal features of network traffic, and can accurately identify various types of abnormal network behaviors such as DDoS attacks, port scanning, SQL injection, and malicious code propagation, adapting to diverse attack scenarios with high classification accuracy.

The invention discloses an SQL injection and storage type XSS detection defense system and method. The method specifically comprises the steps that S1, static analysis is conducted, wherein Web application source codes are scanned, SQL statements in the source codes are positioned, and header identifiers HT and variable identifiers VT in the SQL statements and operation identifiers AT participating in arithmetic or function operation expressions in the SQL statements are recognized and added; s2, dynamic detection and defense: analyzing an identifier added for an SQL statement, executing pre-calculation processing on an operation expression with an operation identifier AT, and identifying SQL injection and storage type XSS attacks caused by the operation expression; defending when an attack is detected; and S3, removing the identifier in the SQL after defense is completed, recovering the SQL statement to a standard SQL statement, and submitting the SQL statement to a database for execution. According to the method, accurate detection and defense are carried out on the SQL statement containing the arithmetic or function operation expression, the detection accuracy is improved, and the false alarm rate is reduced.

The invention belongs to the technical field of network security protection, and discloses a malicious behavior bypass interception system based on flow analysis and detection, a rule engine quickly matches known attacks based on a dynamic feature library, such as SQL injection, common port scanning, federated learning model combined multi-node cooperative training, and flow time, behavior and content features are combined to realize the flow analysis and detection of malicious behaviors. Unknown threats such as 0day vulnerability variants and low-frequency hidden attacks are accurately captured; in an enterprise mixed service traffic environment, missed judgment of traditional static detection on unknown attacks can be avoided, false alarms caused by data limitation of a single model can be reduced, energy consumption of operation and maintenance personnel for processing invalid alarms is reduced, core assets are prevented from being damaged by novel attacks, and comprehensiveness and reliability of network protection are remarkably improved; a bypass deployment mode is adopted, traffic is obtained through network TAP equipment or traffic mirror images, a service main forwarding link does not need to be intervened, and network delay and single-point failure risks introduced by traditional series deployment are avoided.

The application discloses a database auditing system SQL injection detection method based on syntax tree comparison, and sequentially carries out SQL statement preprocessing, constructs a benchmark syntax tree, constructs a malicious syntax tree, compares and analyzes the benchmark syntax tree and the malicious syntax tree, judges attacks on the SQL statement corresponding to the malicious syntax tree, and carries out different early warning operations and generates a report according to the attack judgment. The SQL injection detection method can refine the detection level of SQL injection, carries out different operations on different SQL injection behaviors, prevents resource waste, has more resources for system defense, and improves the defense capability of the system.

The invention discloses an SQL (Structured Query Language) injection feature extraction method and system and a medium, and the method comprises the steps: initializing an original load feature vector, and inputting and traversing an original load data set; reading an original load, and defining a feature group as an SQL injection feature vector; basic scale features, grammar construction features, grammar interpretation features, complexity features, comprehensive description features and character separation features in the feature group are extracted in sequence; constructing a feature matrix, and outputting a standardized feature matrix; according to the method, the appropriate SQL injection features are selected, the stability and reliability of feature extraction are improved, the accuracy of machine learning model training is improved, the SQL injection detection effect is further improved, meanwhile, the calculation cost is reduced, and the method can be suitable for large-scale and high-speed network application scenes.

The present invention provides a web application protection method, system, and computer-readable storage medium. The method comprises: a front-end sending a data request to a back-end, the data request carrying a uniform resource locator (URL) and parameter information; upon receiving the data request, the back-end parsing the parameter information to obtain corresponding parameter values; and the back-end generating corresponding parameter images based on the parameter values, and saving the parameter images to a preset database. By graphically representing parameter values, the present invention can avoid web application risks caused by inserting malicious code into parameters, effectively defend against attacks such as cross-site scripting, SQL injection, file uploads, and brute force attacks, thereby improving the security of web applications and achieving comprehensive protection for web applications. This addresses the problem that existing web application protection methods lack comprehensive protection for web applications.

The present application discloses an AI-based intrusion protection response data processing method and server, which can collect the code of SQL instructions and analyze the code of the SQL instructions using data processing and semantic understanding algorithms based on artificial intelligence and deep learning, so as to capture and depict the abstract syntax tree semantic embedding representation of the SQL instruction code, and filter based on the correlation information between the embedded semantics of each node in the embedded representation, so as to purify the node embedded semantics with higher semantic expression quality to replace the original node. Then, the SQL code semantic encoding based on the tree-shaped long short-term memory network is performed on the abstract syntax tree semantic embedding representation after filtering and purification, so as to utilize the structured dependency relationship between each word in the enhanced SQL instruction code to achieve accurate identification and detection of SQL injection vulnerabilities. In this way, intrusion protection response data processing can be performed more intelligently, helping to automatically identify and detect SQL injection attacks, so as to solve the problem of Trojans from the source and enhance the security of the website.

This invention discloses a method, apparatus, device, and storage medium for detecting SQL injection attacks. The method includes the following steps: based on an abstract syntax tree generated by parsing a received SQL statement, semantically and syntactically encoding the nodes in the abstract syntax tree to obtain semantic feature vectors and syntactic feature vectors for each node; concatenating and fusing the semantic feature vectors and syntactic feature vectors to generate initial features for each node; based on a constructed sparse heterogeneous graph, using a graph convolutional network to propagate the initial features between each node and its neighboring nodes to obtain updated features for each node; performing global average pooling on the updated features of the nodes to obtain a global representation vector of the SQL statement, and inputting the global representation vector into a classifier to output the SQL injection detection result. This application can significantly reduce the computational resource requirements of the model while maintaining high detection accuracy.

The application discloses a SQL injection interception and illegal user identification method based on differential testing, which comprises the following steps: firstly, constructing a message information set containing SQL injection, and building an illegal user information record database; secondly, obtaining the IP address of each message information in the message information set, and inputting the IP address as a keyword into the illegal user information record database for interception discrimination; then, obtaining the keyword information of a target field in the message information which has not been intercepted, and performing differential testing on the keyword information; finally, screening the keyword information and user information such as the IP address in the differential testing case which does not pass, and storing the keyword information and user information into the illegal user information record database, so that the user is an illegal user. The application can actively intercept and record illegal operations of illegal users, effectively reduce the false negative rate, improve the interception rate, and improve the work efficiency of network security maintenance personnel.

This application discloses a method, computer device, and readable storage medium for determining SQL injection vulnerabilities in source code, belonging to the field of source code security detection technology. The method includes the following steps: responding to an SQL injection detection command in the source code, generating a set of legal input parameters based on a legal input scenario corresponding to the source code, and generating a set of test input parameters based on an injection statement library; wherein the injection statement library includes multiple injection statement templates; based on the set of legal input parameters and the source code, collecting first execution data through code instrumentation; based on the set of test input parameters and the source code, collecting second execution data through code instrumentation; and determining SQL injection vulnerabilities in the source code based on the first execution data and the second execution data. This application can reduce the false positive rate of SQL injection vulnerability detection and improve the targeting of SQL injection vulnerability detection.

The application discloses a kind of based on search enhancement SQL injection counter sample generation method, belong to traffic analysis and network security technical field.The application is divided into two links, first collect multiple sets of public traffic data set extraction SQL injection load, generate counter sample by a variety of variation mode, after structured cleaning, vectorization process builds SQL injection counter sample knowledge base.Second, rely on search enhancement generation technology, search similar sample and variation strategy in knowledge base, guide large language model iteration generates new counter sample, and effective sample is supplemented to knowledge base.Finally, normal traffic, original malicious sample and new counter sample are fused to construct training set, and the adversarial training of traffic detection model is completed.The application can improve the diversity and generation efficiency of counter sample, effectively strengthen the recognition ability and overall robustness of detection model to SQL injection variation attack.

The invention discloses a structured query statement injection attack identification method and device. The method comprises the steps of obtaining a to-be-recognized structured query statement; a first feature value corresponding to the to-be-recognized structured query statement is determined, and the first feature value is used for quantitatively representing a grammatical structure and a logic relation of the to-be-recognized structured query statement; the difference degree between the first feature value and a second feature value of a candidate template is determined, the candidate template comprises a sample structured query statement matched with the operation type of the to-be-recognized structured query statement, and the difference degree is used for quantitatively representing the structural similarity degree between the to-be-recognized structured query statement and the candidate template; and determining an identification result of the to-be-identified structured query statement according to the difference degree. According to the method and the device, the technical problem of low detection accuracy caused by matching based on a known attack feature code in an SQL injection detection method adopted in related technologies is solved.

The invention discloses a method for discovering SQL injection attack behaviors based on chaotic parting dimensions, and the method specifically comprises the steps: S1, data collection and feature extraction: obtaining HTTP request data, including SQL query data; extracting the characteristics of the SQL injection attack, wherein the characteristics comprise special characters, SQL keywords and potential malicious structures; s2, calculating a parting dimension; s3, setting a classification dimension threshold value, and if the classification dimension of the selected SQL statement is higher than the threshold value, judging that the SQL statement is an SQL injection attack; and S4, performing anomaly detection and response. The invention mainly relates to the technical field of network security, chaos theory and typing analysis. According to the method, the data is analyzed by using the typing dimension in the chaos theory, the accuracy and efficiency of attack detection are further improved, and nonlinear characteristics and complexity in an attack mode can be revealed, so that the method has advantages in coping with complex attacks.

This application provides a method and apparatus for testing server-side vulnerabilities in web applications. It effectively uncovers potential vulnerabilities through intelligent analysis and feedback mechanisms. By parsing web application pages, extracting key elements, and deriving field matching rules based on server feedback, it generates semantic input samples that conform to the application logic. By comparing historical execution paths, it automatically discovers new paths and further explores potential deep-seated vulnerabilities through mutation operations. This method not only improves test coverage and depth but also dynamically optimizes test samples based on actual feedback, avoiding the blindness and inefficiency of traditional testing methods. This solution can effectively identify various security vulnerabilities in web applications, such as SQL injection and XSS attacks, enhancing the security and reliability of web applications and providing developers with more accurate and efficient vulnerability detection methods.

The embodiment of the invention discloses an SQL (Structured Query Language) injection detection method, which comprises the following steps of: scanning an SQL statement word by word through a preset finite state automaton to obtain a machine lexical type of each lexical unit, constructing a lexical unit queue of the SQL statement on the basis of characters and lexical types of lexical units, and detecting the SQL (Structured Query Language). And obtaining a detection result through a pre-trained detection model for risk control. According to the method, an SQL statement is split through a state transition strategy of a finite state automaton to obtain lexical units, the problem that a regular matching mode cannot adapt to rapidly-changing attacks is avoided, meanwhile, due to the SQL injection principle, the mode for determining the lexical units and the types of the lexical units can effectively recognize zero-day attacks, and therefore the zero-day attacks can be effectively recognized. And the detection accuracy and efficiency of SQL injection are greatly improved.

The embodiment of the invention relates to the field of data processing, and provides an industrial sensitive data-oriented SQL injection response method, which comprises the following steps of: performing feature extraction on an SQL command uploaded by a client to obtain a first feature information set; calculating reasoning score information of an SQL command uploaded by a client according to first feature information in the first feature information set to obtain target score information; generating an injection response scheme corresponding to the SQL command uploaded by the client according to a preset score information threshold and the target score information to obtain a target response scheme; responding to an SQL command uploaded by the client according to the target response scheme to obtain a response result; the accuracy of performing injection response on the SQL uploaded by the client is improved.

The invention relates to the technical field of network security, in particular to a Web authentication enhancement method and system based on user behavior analysis, and the method comprises the following steps: collecting multi-dimensional behavior data of a user, including login behavior data, access behavior data, operation behavior data and equipment fingerprint data; predefining a behavior rule base comprising a login time limit rule, an equipment fingerprint matching rule, an access frequency threshold rule and an operation path compliance rule; the method has the beneficial effects that the system can timely discover and prevent potential security threats, such as cross-site script attack, SQL injection attack, unauthorized access and the like, through predefined behavior rules and real-time comparison of user behaviors. The collection and analysis of the multi-dimensional behavior data enable the system to more comprehensively understand the behavior characteristics of the user, thereby improving the accuracy of authentication.

The invention discloses an SQL (Structured Query Language) injection detection method and device, equipment and a storage medium. The method comprises the steps of obtaining a to-be-detected SQL statement; and for a target execution stage in the SQL statement execution process where the to-be-detected SQL statement is located, performing injection detection on the to-be-detected SQL statement in the target execution stage by adopting a target tangent matched with the target execution stage to obtain an injection detection result. According to the technical scheme, in the target execution stage in the SQL statement execution process where the to-be-detected SQL statement is located, the target tangent plane matched with the target execution stage is adopted to conduct injection detection on the to-be-detected SQL statement in the target execution stage, and therefore the injection detection result is obtained; the detection precision and the detection efficiency of the complex SQL injection attack can be obviously improved.

The application provides a network request risk detection method, system and server, and relates to the field of network request risk detection. The method performs feature fusion on an injection keyword matching result, a network request parameter statistical result and a network request character vectorization result corresponding to to-be-detected data, dynamically optimizes continuous features in the fused feature data, and realizes accurate detection of SQL injection risks in a network request process through a lightweight classifier.

The invention relates to the technical field of computers, in particular to a network security data processing method and device. The method comprises the steps of obtaining current network security data; wherein the current network security data comprises network layer flow data, an application layer log and terminal equipment state data; performing feature extraction on the current network security data to obtain a current network security feature vector; inputting the current network security feature vector into a preset network security event detection model to obtain a current network security event; the current network security event comprises a DDoS attack event, an SQL injection event, a malicious code intrusion event and a data leakage event; according to the invention, based on the current network security event, security early warning of the current network is carried out, so that early warning can be carried out on the network security event more accurately.

This application relates to the fields of IT and software development technology, and provides a method, apparatus, device, and storage medium for generating SQL to prevent injection attacks. The method includes: determining a target mapping file and query conditions; determining a parent class in the target mapping file based on the query conditions; rewriting a preset query method in the parent class; converting all sorting associated with the preset query method in the target mapping file into a `setSort` sorting method of a preset sorting utility class; and sorting the target mapping file using the `setSort` sorting method to generate the final SQL to prevent injection attacks. The SQL generation method for preventing injection attacks provided in this application solves the SQL injection attack problem by uniformly converting the original query methods in the system into `setSort` sorting methods, generating the final SQL to prevent injection attacks with only minor modifications to the original sorting code.

The invention discloses a business data isolation method and device, electronic equipment and a storage medium, and relates to the technical field of data processing.According to the business data isolation method and device, the tenant identification serves as the core, access permission is analyzed and verified to intercept illegal requests, and the SQL injection risk is completely eradicated; a database operation request is switched to a tenant exclusive database instance through a dynamic data source routing engine, and tenant data physical isolation is achieved in cooperation with a dynamically mounted independent storage partition; meanwhile, unified resource scheduling is guaranteed through unvarnished transmission of the context of the tenants, and the completely centralized performance problem and the completely distributed redundancy defect are avoided; the technical effects of guaranteeing tenant data physical isolation and safety, avoiding SQL injection risks, improving system performance stability in a thousand-level tenant scene, reducing deployment redundancy, unifying data standards, improving resource utilization rate and adapting to insurance industry multi-tenant business management requirements are achieved.

The embodiment of the invention discloses a method, device and equipment for determining the resistance capability of a firewall and a storage medium. The method comprises the following steps: acquiring a rule of a Web application firewall connected with a Web server; determining a structured query language (SQL) statement in the Web server; and determining whether the Web application firewall has the capability of resisting SQL injection or not based on the rule of the Web application firewall, the SQL statement, the lexical rule of the SQL and the grammatical rule of the SQL. According to the method and the device, on the basis of the rule of the Web application firewall and the SQL statement in the Web server, the defense capability of the Web application firewall is verified by utilizing the lexical rules of the SQL and the grammatical rules of the SQL, a violent test mode does not need to be adopted, the test efficiency is improved, and the cost is reduced.

This invention relates to the field of computer security and proposes an automated method for discovering Java Spring SQL / SSRF vulnerabilities based on parameter flow simulation. The method includes the following steps: S1, parsing the class files compiled from the source project in the JAR package to be discovered, traversing the class files in the JAR package, and extracting the input parameters of the Mapping methods under the Controller as the starting point for taint analysis, serving as the source of taint propagation; and performing vulnerability chain detection based on the method set S-1, the SQL injection vulnerability taint function set S-2, and the SSRF taint function set S-3 propagated step-by-step by the method parameters. This invention aims to improve the accuracy and coverage of existing static analysis tools in identifying SQL / SSRF vulnerabilities in the Java Spring framework, offering advantages such as high efficiency, accuracy, and high coverage.

The application discloses a SQL injection vulnerability detection method and device, electronic equipment and a storage medium. The method comprises the following steps: determining a data input point and test data of an application to be detected, wherein the test data is a string of SQL symbols, and the SQL symbols are determined based on a SQL statement associated with the data input point; inputting the test data to the data input point, and obtaining an execution result of a test statement generated based on the application, wherein the test statement is determined based on the test statement and a SQL statement corresponding to the data input point; comparing the execution result of the test statement with preset reference information, and determining that a SQL injection vulnerability exists in the SQL statement corresponding to the data input point in the case that the reference information matches the execution result. By using the application, the vulnerability detection efficiency and the accuracy of the vulnerability detection can be effectively improved, and the normal use of the application by a user is not easily disturbed.

This application discloses an SQL injection detection method, apparatus, electronic device, storage medium, and program product, belonging to the field of computer technology. The method includes: extracting target detection features corresponding to an SQL statement to be detected; obtaining clusters matching the target detection features from a Markov network, wherein the Markov network is constructed based on multiple initial detection features and logical rules defining the relationships between the initial detection features, the Markov network includes multiple clusters, each cluster consists of nodes satisfying the same logical rule, the weight of each cluster is the weight of the corresponding logical rule, each node corresponds to one initial detection feature, and each logical rule is used to characterize a group of high-risk node combinations; determining the risk probability corresponding to the SQL statement to be detected based on the matching clusters; and determining the injection detection result corresponding to the SQL statement to be detected based on the risk probability.