基于HMM的SQL注入攻击威胁评估系统的研究与实现

发布时间：2018-04-05 04:04

本文选题：SQL注入检测　切入点：态势评估　出处：《哈尔滨理工大学》2017年硕士论文

【摘要】：随着企业互联网业务的不断发展,网络安全问题逐渐引起公众的关注。而且随着互联网的普及、网络设备的升级、带宽的加大,网络攻击方式多样化、频率也有了很大的提升。SQL注入漏洞是当前网络应用所面临的最严峻的安全问题,如果攻击成功很可能引发系统沦陷问题,由此可见对SQL注入漏洞检测的研究有很重要的实际意义。目前市面虽然存在着大量SQL注入漏洞检测工具,但是普遍存在检测速度慢,误报率高等问题,而且当产生的记录攻击日志成几何级数般增长时,导致网络管理员难以及时掌握网络安全状况,也就不能及时给出对应方案。如果能实现对当前网络安全态势的实时追踪评估,网络管理员就能依据评估结果尽快找到解决问题的办法。针对这些需求,本文设计了一种SQL注入漏洞的检测工具,并将其与经过改进的网络安全态势评估系统相结合,以达到实时检测、及时防御的目的。本文主要工作如下:首先分析了国内外SQL注入检测的研究现状,结合项目实际需求,设计了一款检测SQL注入攻击的工具,该工具集成优化的爬虫技术、AES加密算法与漏洞验证机制等技术提高了扫描器的检测精度和速度;其次分析了国内外网络安全态势评估方法的研究现状,对传统的隐Markov模型进行改进,定义了状态转移矩阵初步生成的算法,通过对系统检测数据的融合,从中提取观测向量,生成网络状态转移矩阵,并推导出隐含状态概率分布序列求解过程;最后根据国际定义,运用风险损失向量计算方法计算当前网络风险值,评估出整体安全态势。最后运用真实数据对该系统进行验证,实验表明,该系统符合实际应用,评估结果准确有效。
[Abstract]:With the continuous development of the Internet business enterprise, the problem of network security has attracted public attention. But with the popularity of the Internet, network equipment upgrade, increase bandwidth, network attack frequency diversity, also greatly enhance the.SQL injection vulnerability is the most serious security issues currently facing the network application, if the attack is successful it may cause the system to fall, it has very important practical significance of the research on SQL injection vulnerability detection. At present the market although there are a large number of SQL injection vulnerability detection tools, but generally kept in slow detection speed and high false alarm rate, and when the attack logs record geometrically growth, leading to the network administrator it is difficult to grasp the situation of network security, it can not be given corresponding solutions. If you can achieve real-time tracking of the current network security situation The network administrator can evaluate, according to the evaluation results as soon as possible to find a solution to the problem. According to these requirements, this paper designs a SQL injection vulnerability detection tools, and combined with the network security situation assessment through the improvement of the system, in order to achieve the purpose of real-time detection and defense. The main work is as follows: firstly, analysis the research status at home and abroad to detect SQL injection, combined with the actual needs of the project, the design of a SQL injection attack detection tools, the tool crawler technology integration and optimization, AES encryption algorithm and vulnerability verification mechanism improves the accuracy and speed of detection scanner; secondly analyzes the research status quo of domestic and international network security situation assessment method the hidden Markov model to improve the traditional definition, the initial state transition matrix generation algorithm, through the integration of test data of the system, from the view of extraction Test vector generation network state transition matrix, and deduced the hidden state probability distribution sequence solving process; finally according to the definition, the use of risk loss vector method to calculate the current network risk value, evaluate the overall security situation. Finally the verification of the system of real data experiments show that the system meets the requirements of practical application, accurate and effective the results of the assessment.

【学位授予单位】：哈尔滨理工大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.08;TP311.52

【相似文献】