用于SQL注入检测的语句块摘要树模型

SQL注入具有危害性大而实施简单的特点,目前已经成为危害网络信息安全的主要攻击方法之一。本文提出一个用于SQL注入检测的语句块摘要树模型,定义抽象SQL语句、语句块和反映应用系统功能的语句块摘要树,给出该树的生成算法和基于该树的SQL注入检测算法,将检测纳入到应用系统执行的SQL语句序列上下文中,提高了检测的准确性,降低了误报率。实验表明,基于语句块摘要树模型实现SQL注入检测的中间件对系统性能影响很小,说明了模型的有效性和可行性。

Statement Block Digest Tree Model for SQL Injection Detection

For its big harm and easiness of carrying out, SQL Injection is now a main attacking method hurting the network and information security. This paper proposes a statement block digest tree model for SQL injection detection. This model defines abstract SQL statement, SQL statement block and itsdigest tree in accordance with the function of application, and presents algorithms generating the tree and detecting SQL injection based on the tree. By putting detection on the context of executing SQL statement sequence of application, this model increases the veracity and decreases the mistake rate of detection. Experiments show that the SQL injection detection middleware implemented the model only makes little affect on the performance of system, andimply that the model is efficient and feasible.