CN114036509B - A SQL Injection Statement Transformation Method Based on Context-Free Grammar - Google Patents
A SQL Injection Statement Transformation Method Based on Context-Free GrammarInfo
- Publication number
- CN114036509B CN114036509B CN202111386230.2A CN202111386230A CN114036509B CN 114036509 B CN114036509 B CN 114036509B CN 202111386230 A CN202111386230 A CN 202111386230A CN 114036509 B CN114036509 B CN 114036509B
- Authority
- CN
- China
- Prior art keywords
- sql injection
- context
- free grammar
- statement
- constructing
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/554—Detecting local intrusion or implementing counter-measures involving event detection and direct action
-
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Theoretical Computer Science (AREA)
- Software Systems (AREA)
- Computer Hardware Design (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Health & Medical Sciences (AREA)
- Bioethics (AREA)
- General Health & Medical Sciences (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
The invention discloses a SQL injection statement transformation method based on context-free grammar, which needs to generate a large amount of semantic equivalent transformation for SQL injection statements when network security attack and defense research is carried out. The invention is based on improved context-free grammar, combines with methods such as semantic matching and the like, can generate theoretically infinite equivalent substitutions according to a single SQL injection statement, and has semantically equivalent meaning that the functionality and the maliciousness of the SQL injection statement are reserved. The method uses a semantic-based mode to match the entries generated by replacement, and avoids the damage of the regular matching method to the functionality of the SQL injection statement while processing the SQL injection statement in a finer granularity.
Description
Technical Field
The invention belongs to the technical field of network security, and particularly relates to an SQL injection statement transformation method based on a context-free grammar.
Background
With the continued evolution and global deployment of the internet, web services play an increasingly important social infrastructure role in everyday life. But on the other hand they are also faced with global threats from different sites, different scales and by different means. Common Web threats include SQL injection, cross-site scripting, cross-site request forging, distributed denial of service, and the like. SQL (Structured Query Language) injection is one of the most common and threatening ways of attack, and an attacker exploits security holes by making SQL queries to databases, directly accessing unauthorized information, creating or modifying new user rights, or otherwise manipulating sensitive information.
The SQL injection statement serves as the most core content in the process of utilizing SQL injection holes, and plays roles of triggering holes, stealing data, tampering content and the like. From the perspective of security research, no matter attack or SQL injection defense, the equivalent transformation of the injected sentences is indispensable, the traditional method mainly concentrates the replacement based on regular matching, and the functionality and the maliciousness of the SQL injection cannot be ensured, namely the SQL injection can not be triggered normally after modification. The method is replaced based on semantic equivalence, so that attack and defense research, such as optimization of SQL injection interception by a firewall, can be promoted.
Disclosure of Invention
The invention aims at overcoming the defects of the prior art and provides a SQL injection statement transformation method based on a context-free grammar.
The invention aims at realizing the technical scheme that the SQL injection statement transformation method based on the context-free grammar comprises the following steps:
(1) A context-free grammar rule set G is constructed, which comprises four parts, namely, g= (V, Σ, S, R), including a non-terminal set V, a terminal set Σ, a start variable set S, and a production set R.
(1.1) Constructing a non-terminal symbol set V for expanding the generation range of SQL injection sentences, and representing intermediate states, namely potential generation targets.
(1.2) Constructing a set of terminators Σ, referring to the actual content generated, such as generating boolean expressions, equations, inequalities, etc.
(1.3) Constructing a start variable set S, namely, an entry of a program when SQL injection statement transformation is performed, such as the type of equation, number, letter and the like.
(1.4) Constructing a set of generator formulas R, R being a relationship from V to (V n Σ *), representing repeating one or more times for iteratively processing S to generate a final SQL implant statement.
(2) The SQL injection statement is partitioned according to common punctuation marks (such as commas, semicolons, spaces, etc.), and the partitioned contents are inserted into a set D, d= { D i |i=1, 2.
(3) Each element D i in D is semantically (e.g., equation, number, letter, etc.) matched to the contents of the variable set S in the context-free grammar rule set G and t alternatives are generated and inserted into the set M i, i.e., |m i＝G(di) |=t, and m= { M i |i=1, 2.
(4) And randomly taking a piece of replacement content from each subset M i in M, and recombining according to the order of i from small to large to obtain a final SQL injection statement transformation result.
Compared with the prior art, the invention has the following beneficial effects:
(1) The invention is based on improved context-free grammar, can generate theoretically infinite substitutions according to a single SQL injection statement, and has semantically equivalent meaning that the functionality and the maliciousness are reserved;
(2) The method uses a semantic-based mode to match the entries generated by replacement, and avoids the damage of the regular matching method to the functionality of the SQL injection statement while processing the SQL injection statement in a finer granularity.
Drawings
FIG. 1 is a flow chart of the SQL injection statement transformation method of the invention.
Detailed Description
As shown in FIG. 1, the SQL injection statement transformation method based on the context-free grammar constructs the context-free grammar by defining a start variable set, a terminator set, a non-terminator set, a generation set and the like, and further generates a large amount of equivalent transformations for the SQL injection statement through the context-free grammar, so that the transformation result of the SQL injection statement is more real, namely the functionality and the maliciousness of the SQL injection statement are reserved. The method specifically comprises the following steps:
(1) A context-free grammar rule set G is constructed, which comprises four parts, namely, g= (V, Σ, S, R), including a non-terminal set V, a terminal set Σ, a start variable set S, and a production set R.
(1.1) Constructing a non-terminal symbol set V for expanding the generation range of SQL injection sentences, and representing intermediate states, namely potential generation targets.
(1.2) Constructing a set of terminators Σ, referring to the actual content generated, such as generating boolean expressions, equations, inequalities, etc.
(1.3) Constructing a start variable set S, namely, an entry of a program when SQL injection statement transformation is performed, such as the type of equation, number, letter and the like.
(1.4) Constructing a set of generator formulas R, R being a relationship from V to (V n Σ *), representing repeating one or more times for iteratively processing S to generate a final SQL implant statement.
(2) The SQL injection statement is partitioned according to common punctuation marks (such as commas, semicolons, spaces, etc.), and the partitioned contents are inserted into a set D, d= { D i |i=1, 2.
(3) Each element D i in D is semantically (e.g., equation, number, letter, etc.), matches the contents of the variable set S in the context-free grammar rule set G, and generates t alternatives inserted into the subset M i, i.e., M i＝G(di), and |m i|＝|G(di) |=t, and the set m= { M i |i=1, 2,..n.
(4) And randomly taking a piece of replacement content from each subset M i in the set M, and recombining according to the order of i from small to large to obtain a final SQL injection statement transformation result.
Claims (4)
1. The SQL injection statement transformation method based on the context-free grammar is characterized by comprising the following steps of:
(1) Constructing a context-free grammar rule set G, wherein the context-free grammar rule set G comprises four parts, namely a non-terminal symbol set V, a terminal symbol set sigma, a start variable set S and a generation type set R, namely G= (V, sigma, S, R);
(2) Dividing the SQL injection statement according to punctuation marks, and inserting the divided contents into a set D, wherein D= { D i |i=1, 2, & gt, N };
(3) Each element D i in D is matched with the content of the variable set S in the context-free grammar rule set G according to semantics, and t replacement contents are generated and inserted into the set M i, i.e., |m i＝G(di) |=t, and m= { M i |i=1, 2.
(4) And randomly taking a piece of replacement content from each subset M i in M, and recombining according to the order of i from small to large to obtain a final SQL injection statement transformation result.
2. The method for transforming SQL injection statements based on context-free grammar of claim 1, the method is characterized in that the step (1) comprises the following steps:
(1.1) constructing a non-terminal symbol set V for expanding the generation range of SQL injection sentences to represent intermediate states, namely potential generation targets;
(1.2) constructing a set of terminators Σ, referring to the generated actual content, such as generating boolean expressions, equations, inequalities, etc.;
(1.3) constructing a start variable set S, namely an entry of a program when SQL injection statement transformation is performed, such as equations, numbers, letters and the like;
(1.4) constructing a set of generator formulas R, R being a relationship from V to (V Σ) *, representing repeating one or more times for iteratively processing S to generate a final SQL injection statement.
3. The method of claim 1, wherein in step (2), punctuation marks include commas, semicolons, spaces, and the like.
4. The method of claim 1, wherein in step (3), the semantics include equations, numbers, letters, etc.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111386230.2A CN114036509B (en) | 2021-11-22 | 2021-11-22 | A SQL Injection Statement Transformation Method Based on Context-Free Grammar |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202111386230.2A CN114036509B (en) | 2021-11-22 | 2021-11-22 | A SQL Injection Statement Transformation Method Based on Context-Free Grammar |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN114036509A CN114036509A (en) | 2022-02-11 |
| CN114036509B true CN114036509B (en) | 2025-12-05 |
Family
ID=80138386
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202111386230.2A Active CN114036509B (en) | 2021-11-22 | 2021-11-22 | A SQL Injection Statement Transformation Method Based on Context-Free Grammar |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114036509B (en) |
Family Cites Families (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CA1265871A (en) * | 1986-11-18 | 1990-02-13 | Yawar Bakht Ali | Domain-independent natural language database interface |
| AU1926300A (en) * | 1998-11-30 | 2000-06-19 | Lexeme Corporation | A natural knowledge acquisition method |
| US20050038781A1 (en) * | 2002-12-12 | 2005-02-17 | Endeca Technologies, Inc. | Method and system for interpreting multiple-term queries |
| AU2013206632A1 (en) * | 2005-11-09 | 2013-07-18 | Philera New Zealand Limited | Treatment of mitochondria-related diseases and improvement of age-related metabolic deficits |
| US8302080B2 (en) * | 2007-11-08 | 2012-10-30 | Ntt Docomo, Inc. | Automated test input generation for web applications |
| RU2592396C1 (en) * | 2015-02-03 | 2016-07-20 | Общество с ограниченной ответственностью "Аби ИнфоПоиск" | Method and system for machine extraction and interpretation of text information |
| CN105446743A (en) * | 2015-12-12 | 2016-03-30 | 天津南大通用数据技术股份有限公司 | System and method for automatically generating SQL sentences |
| CN106503557B (en) * | 2016-07-08 | 2019-10-08 | 北京卫达信息技术有限公司 | SQL injection attack defending system and defence method based on dynamic mapping |
-
2021
- 2021-11-22 CN CN202111386230.2A patent/CN114036509B/en active Active
Non-Patent Citations (2)
| Title |
|---|
| 云环境下的WAF自动绕过方法研究;曲振青;信息科技;20230815(第8期);3-8 * |
| 自动生成SQL测试用例集的研究与实现;张钦;信息科技;20120615(第6期);4-13 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN114036509A (en) | 2022-02-11 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN111163086B (en) | Multi-source heterogeneous network security knowledge graph construction and application method | |
| US10454969B2 (en) | Automatic generation of low-interaction honeypots | |
| US8225402B1 (en) | Anomaly-based detection of SQL injection attacks | |
| EP3514722B1 (en) | Secure substring search to filter encrypted data | |
| Luo et al. | A CNN-based Approach to the Detection of SQL Injection Attacks | |
| CN103338208B (en) | Method and system for SQL injection and defense | |
| Yang et al. | How to learn klingon without a dictionary: Detection and measurement of black keywords used by the underground economy | |
| CN105577660A (en) | DGA domain name detection method based on random forest | |
| WO2010024116A1 (en) | Search device, search method and search program using open search engine | |
| US11775749B1 (en) | Content masking attacks against information-based services and defenses thereto | |
| CN115314236A (en) | System and method for detecting phishing domains in a Domain Name System (DNS) record set | |
| Liu et al. | Deep learning in cybersecurity: a hybrid BERT–LSTM network for SQL injection attack detection | |
| Pham et al. | Exploring efficiency of GAN-based generated URLs for phishing URL detection | |
| CN110245195B (en) | Structured query language injection detection method and device based on honeypot system | |
| CN114036509B (en) | A SQL Injection Statement Transformation Method Based on Context-Free Grammar | |
| CN107463845B (en) | Method, system and computer processing device for detecting SQL injection attack | |
| Xue et al. | Phishing sites detection based on Url Correlation | |
| CN107222494A (en) | A kind of SQL injection attack defending component and method | |
| CN103944901A (en) | Detection method and device for control nodes of social bot network | |
| Zhao et al. | Forward privacy multikeyword ranked search over encrypted database | |
| CN108173818A (en) | A kind of network security threats analysis method and system based on Proxy daily record datas | |
| CN114036508B (en) | SQL injection statement analysis method based on tree structure | |
| CN114793164B (en) | Multi-feature-based APT attack event correlation method | |
| CN118445454A (en) | Method and system for querying convenience comprehensive information based on encryption technology and cloud computing | |
| CN102298581B (en) | A kind of disposal route of input method dictionary and device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |