SQL Injection Detection via Syntax Tree and Semantic Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current SQL injection interception methods, primarily relying on Web Application Firewalls (WAF) with regular rules, suffer from high false positive rates due to complex situations that are difficult to describe, leading to ineffective detection of malicious SQL instructions.
Innovation Solution
A method and device that utilize a SQL syntax tree rule to detect malicious instructions, and an analysis model to determine potentially malicious instructions by generating vectors and calculating similarity with malicious SQL instruction samples, with the option to update a blacklist for improved detection and prevention.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If regular rules based on text characteristics are used for SQL injection detection, then the detection method is simple to implement, but the false positive rate is high
Solution Approach 1:
The patent segments the SQL detection process into two distinct stages: syntax tree rule detection for structured analysis and semantic analysis model detection for complex pattern recognition. This segmentation allows each method to focus on specific aspects, reducing false positives while maintaining implementation feasibility
Solution Approach 2:
The patent introduces a syntax tree structure as an intermediary representation between the raw SQL text and the detection rules. This intermediary enables more precise matching by capturing the hierarchical structure of SQL statements, thereby reducing false positives while keeping the detection system implementable
2Ease of manufacture
If regular rules based on text characteristics are used for SQL injection detection, then the implementation is straightforward, but the detection accuracy is low
Solution Approach 1:
The detection system is divided into syntax tree rule detection and semantic analysis detection, allowing straightforward implementation of rule-based detection while adding semantic analysis to improve accuracy for complex cases
Solution Approach 2:
The patent changes the detection parameters from simple text matching to structured syntax tree analysis and semantic vector analysis. This parameter change enables more accurate detection of malicious SQL instructions while maintaining the simplicity of rule-based approaches for common cases
3Measurement precision
If syntax tree analysis and similarity calculation are combined for SQL injection detection, then the detection accuracy is improved, but the system complexity increases
Solution Approach 1:
The system is segmented into distinct modules: syntax tree construction, rule-based detection, semantic vector generation, and similarity calculation. This segmentation improves detection accuracy while managing complexity through modular design
Solution Approach 2:
The patent performs preliminary actions by pre-compiling syntax tree rules and pre-training semantic analysis models. This preliminary preparation reduces runtime complexity while maintaining high detection accuracy during actual SQL instruction analysis
Data Source
AI summary
A method for detecting SQL injection interception is provided. The method includes: detecting a received SQL instruction according to a SQL syntax tree rule to determine that the received SQL instruction is a malicious instruction; and analyzing the received SQL instruction by using an analysis model to determine that the received SQL instruction is a potentially malicious instruction, in a case that the received SQL instruction is not determined to be a malicious instruction according to the SQL syntax tree rule. The method can combine the online detection and the offline analysis to intercept the invading malicious SQL commands, and can also find and supplement the loopholes of the rules through offline analysis.