Data-mining based SQL injection attack detection using internal query trees

Detecting SQL injection attacks (SQLIAs) is becoming increasingly important in database-driven web sites. Until now, most of the studies on SQLIA detection have focused on the structured query language (SQL) structure at the application level. Unfortunately, this approach inevitably fails to detect those attacks that use already stored procedure and data within the database system. In this paper, we propose a framework to detect SQLIAs at database level by using SVM classification and various kernel functions. The key issue of SQLIA detection framework is how to represent the internal query tree collected from database log suitable for SVM classification algorithm in order to acquire good performance in detecting SQLIAs. To solve the issue, we first propose a novel method to convert the query tree into an n-dimensional feature vector by using a multi-dimensional sequence as an intermediate representation. The reason that it is difficult to directly convert the query tree into an n-dimensional feature vector is the complexity and variability of the query tree structure. Second, we propose a method to extract the syntactic features, as well as the semantic features when generating feature vector. Third, we propose a method to transform string feature values into numeric feature values, combining multiple statistical models. The combined model maps one string value to one numeric value by containing the multiple characteristic of each string value. In order to demonstrate the feasibility of our proposals in practical environments, we implement the SQLIA detection system based on PostgreSQL, a popular open source database system, and we perform experiments. The experimental results using the internal query trees of PostgreSQL validate that our proposal is effective in detecting SQLIAs, with at least 99.6% of the probability that the probability for malicious queries to be correctly predicted as SQLIA is greater than the probability for normal queries to be incorrectly predicted as SQLIA. Finally, we perform additional experiments to compare our proposal with syntax-focused feature extraction and single statistical model based on feature transformation. The experimental results show that our proposal significantly increases the probability of correctly detecting SQLIAs for various SQL statements, when compared to the previous methods.     

大型空分制氧站DCS调试技术

以宝钢集团浦钢60000 Nm3/h的大型空分制氧站DCS调试为基础,结合以往大型空分制氧站DCS调试经验,探讨了大型空分制氧站DCS调试的特点、施工组织、调试工艺及方法,并对控制回路试验、离心式压缩机防喘振控制组态、压缩机起停及控制逻辑、紧急停车及重要安全回路调试、组态临时变更管理等重点、难点及关键环节的调试技术进行了详细的总结、说明,旨在为其他同类工程提供参考与借鉴.     

双阳煤在PKM气化炉试烧总结

介绍了在PKM气化炉中弱粘结性双阳煤的试烧情况,并给出了主要工艺参数控制范围。试烧结果表明:依兰煤中配入50%双阳煤,汽氧比6.0:1时,气化炉工况良好。     

碰撞式混合器的设计和使用

从反应注射成型过程对混合器的结构设计、操作条件等的要求出发，对碰撞式混合器的设计和使用应注意的问题进行了分析探讨，并提出了相应的解决办法和处理措施。     

The removal of dichloromethane from atmospheric pressure air streams using plasma-assisted catalysis

Plasma-assisted catalysis was used for the destruction of 500 ppm of dichloromethane, CH₂Cl₂ (DCM), in gas streams of air using a non-thermal, atmospheric pressure plasma utilising a dielectric packed bed. The combination of plasma and catalyst gave improved destruction of DCM. Eight catalysts which including alumina, TiO₂ and various zeolites were investigated with the finding that alumina in a one-stage reactor configuration and TiO₂ and HZSM-5 in two-stage configurations gave the best DCM destructions. The sodium zeolites are capable of reducing by 50% the unwanted NO_x by-products, formed by plasma processing in air. The nature of the catalyst is important in terms of the destruction efficiency, end-product selectivity and NO_x reduction.     

基于List集合的多条件查询优化算法研究

在数据库应用程序的研发过程中,经常涉及到对数据表的任意字段进行任意形式的组合查询,这样可以大大缩小查询范围,这就是多条件查询。文章首先对多条件查询的常用方法予以介绍,包括枚举法、递进法;最后笔者给出防止注入攻击的基于List集合的多条件查询优化算法。同时,为了提高性能,避免产生垃圾内存,SQL语句都使用StringBuilder类来创建字符串实例进行拼接,文中的代码均在VS2008平台下运行通过。     

用双层辉光等离子法在钛表面制备的Ti-Pd合金层性能研究

采用双层辉光等离子冶金技术在纯钛表面制备了Ti—Pd合金层。其深度大约为90μm，Pd含量呈梯度变化，并出现了TiPd3，TiPd2，Ti2Pd3，Ti3Pd5，TiPd，Ti4Pd等6种化合物相和Pd相。合金层在100℃的NaCl饱和溶液＋HCl溶液以及40℃的8．6％H2SO4溶液中的耐缝隙腐蚀性能优于Ti0．2Pd合金；在室温80％H2SO4的溶液中，腐蚀速率仅为0．682mm／a，是Ti0．2Pd合金的18．2％：在室温30％HCl的溶液中，表面Ti—Pd的腐蚀速率仅为0．004mm／a，是Ti0．2Pd合金的12．5％。     

基于I2C总线技术的等离子喷焊系统的研究

阐述了基于I^2C总线技术的等离子喷焊过程控制系统的设计原理，介绍了软硬件及接口设计技术。实践表明，采用I^2C总线技术，不仅使系统的芯片大大减少，系统的灵活性增强，而且提高了系统的抗干扰能力。     

High-temperature oxidation of SiC in a glow-discharge oxygen plasma

The oxidation kinetics and structure of the oxide scales formed on high-density SiC were studied in molecular oxygen at 740 Torr and in a glow-discharge oxygen plasma at 0.1 Torr at temperatures of 1000, 1100, and 1200°C. The monatomic oxygen formed by the glow discharge markedly increased the reaction rate and the vaporization of some of the oxidation products. The marked differences in kinetics suggest that the rate-controlling step during oxidation in molecular oxygen is the dissociation of adsorbed diatomic oxygen to the monatomic species. Films formed in molecular oxygen were mostly amorphous SiO₂ with small inclusions of SiC and graphite, whereas films formed in dissociated oxygen were primarily amorphous SiO₂ containing SiO, S₂O₃, and the coesite form of SiO₂.