Data-mining based SQL injection attack detection using internal query trees

Detecting SQL injection attacks (SQLIAs) is becoming increasingly important in database-driven web sites. Until now, most of the studies on SQLIA detection have focused on the structured query language (SQL) structure at the application level. Unfortunately, this approach inevitably fails to detect those attacks that use already stored procedure and data within the database system. In this paper, we propose a framework to detect SQLIAs at database level by using SVM classification and various kernel functions. The key issue of SQLIA detection framework is how to represent the internal query tree collected from database log suitable for SVM classification algorithm in order to acquire good performance in detecting SQLIAs. To solve the issue, we first propose a novel method to convert the query tree into an n-dimensional feature vector by using a multi-dimensional sequence as an intermediate representation. The reason that it is difficult to directly convert the query tree into an n-dimensional feature vector is the complexity and variability of the query tree structure. Second, we propose a method to extract the syntactic features, as well as the semantic features when generating feature vector. Third, we propose a method to transform string feature values into numeric feature values, combining multiple statistical models. The combined model maps one string value to one numeric value by containing the multiple characteristic of each string value. In order to demonstrate the feasibility of our proposals in practical environments, we implement the SQLIA detection system based on PostgreSQL, a popular open source database system, and we perform experiments. The experimental results using the internal query trees of PostgreSQL validate that our proposal is effective in detecting SQLIAs, with at least 99.6% of the probability that the probability for malicious queries to be correctly predicted as SQLIA is greater than the probability for normal queries to be incorrectly predicted as SQLIA. Finally, we perform additional experiments to compare our proposal with syntax-focused feature extraction and single statistical model based on feature transformation. The experimental results show that our proposal significantly increases the probability of correctly detecting SQLIAs for various SQL statements, when compared to the previous methods.     

网络融合边界的电信DoS攻击检测*

为了检测网络融合边界的电信拒绝服务攻击,首先针对攻击的类型分别提出了基于呼叫统计或流量信号分析的检测方法,并采用分步骤的策略设计了检测系统,将两种检测算法分别应用于粗检测步骤,再通过精检测步骤确认攻击并找出攻击源.模拟实验结果表明,该方案能够有效地检测出典型的攻击,并能够实时在线检测,具有良好的实用价值,为应对网络融合所带来的新安全问题提供了一种解决方案.     

基于List集合的多条件查询优化算法研究

在数据库应用程序的研发过程中,经常涉及到对数据表的任意字段进行任意形式的组合查询,这样可以大大缩小查询范围,这就是多条件查询。文章首先对多条件查询的常用方法予以介绍,包括枚举法、递进法;最后笔者给出防止注入攻击的基于List集合的多条件查询优化算法。同时,为了提高性能,避免产生垃圾内存,SQL语句都使用StringBuilder类来创建字符串实例进行拼接,文中的代码均在VS2008平台下运行通过。     

基于LM3S316的微控制器仿真USB设备

提出了基于LM3S316实现与PC机通讯的方法.给出了硬件实现及软件设计思想.该方法使用微控制器仿真USB设备,降低了功耗、成本.     

基于USB的矿井气体检测系统

目前我国煤矿中使用的气体传感器的校验和分析大多采用纯手工操作,原始数据量大、校验时间长,给煤矿安全带来很大隐患。针对该问题,文章提出了一种基于USB的矿井气体检测系统的设计方案。该系统采用以ARM为核心的嵌入式技术和USB接口技术,可实现多种气体数据信息的实时采集、存储与传输功能,并可在上位机上实时显示。试运行结果表明,该基于USB的矿井气体检测系统数据处理速度快,方便可靠,有较好的实时性。     

CCA-secure unidirectional proxy re-encryption in the adaptive corruption model without random oracles

Up to now, it is still an open question of how to construct a chosen-ciphertext secure unidirectional proxy re-encryption scheme in the adaptive corruption model. To address this problem, we propose a new unidirectional proxy re-encryption scheme, and prove its chosen-ciphertext security in the adaptive corruption model without random oracles. Compared with the best known unidirectional proxy re-encryption scheme proposed by Libert and Vergnaud in PKC’08, our scheme enjoys the advantages of both higher effi...     

通用串行总线设备固件的设计

该文描述使用８ｘ９３０ａｘ微处理器开发通用串行总线设备固件的技术。     

基于多信号模型的在线测试系统设计

本文介绍了基于多信号模型方法的舰载武器在线测试系统的设计,介绍了其硬件、软件组成及主要故障诊断算法.测试系统由三通连接器、多个带USB接口的智能数据采集适配器、加固计算机及相应的测试电缆组成,各智能适配器可通过现场组合配置成相应的测试系统资源,从而具有体积小、上舰方便及通用性强等特点.对不同类型的武器系统,采用与之配套的三通连接器及更改软件设置可用于相应的武器系统测试.     

一种基于USB协议的无线网卡自启动方法

为了解决传统无线网卡体积大、自启动过程不稳定等问题,针对高通平台的无线网卡,根据MSM6290芯片组解决方案用一个单独的应用处理器实现单一芯片上的数字和模拟功能,并通过基于USB协议的SCSI命令处理实现虚拟光驱设备和USB协议栈的重启。实现结果显示,这种基于USB协议的无线网卡自启动方法可显著改善设备自启动的效率及稳定性,能使3G无线网卡具有更好的应用性能。     

CCD在桥梁振动检测中的应用

根据桥梁振动检测的工作特点及要求,为实现非接触、动态自动化检测,基于CCD远距离、非接触测量技术,采用硬件电路设计完成了与USB端口的数据传输,通过确定固定条码标尺中心位置的上下偏移量实现对桥梁状态的检测.采用Visual C 6.0作为开发环境,完成了用户应用程序.该方法具有测量精度高、操作简便、性价比高等优点,非常便于野外作业,在实际检测中得到很好的应用.