基于机器学习的SQL注入检测技术研究

发布时间：2018-06-08 15:42

本文选题：SQL注入 + 词法分析　；参考：《南京邮电大学》2017年硕士论文

【摘要】：随着近年来计算机技术的不断发展,各式各样的Web应用程序迅速涌现,给人们的生活和办公带来极大的便利,人们的生活也越来越离不开网络。然而,各种资产和信息的网络化也引发了各种各样的安全问题。其中,SQL注入是一种实现难度低,发生频率高,技术更新快的网络攻击技术,其主要危害包括用户信息的泄漏,系统权限的获取以及篡改网页信息等。目前,针对SQL注入的主要防御方法包括编码过程安全化、基于程序分析和基于特征匹配的检测系统等,这些防御方法均存在信息要求多、开发过程长、部署难度高等问题。因此,本文提出一种工作在HTTP应用层,在对后台程序一无所知的情况下,仅通过分析用户输入就能检测到潜在威胁的SQL注入检测技术。本文提出的SQL注入检测模型通过对用户输入进行预处理,词法分析,语法分析,机器学习的步骤对用户输入进行检测,并输出威胁级别。该SQL检测模型的特点为:仅需要提取用户输入,不需要其他后台信息;对用户输入递归解码,尽可能解析出可能的payload;通过词法分析和语法分析后抽象出样本的语法树,并进行机器学习;设置了两种机器学习的模型,验证结果更可靠;可以区分威胁的级别,让用户更方便的处理不同等级的攻击。实验表明,相比于其他的SQL注入检测模型,该模型在仅采集用户输入的情况下具有较高的准确性和检测效率,能有效的检测出SQL注入攻击。
[Abstract]:With the development of computer technology in recent years, a variety of Web applications have emerged rapidly, bringing great convenience to people's life and office, and people's lives are more and more inseparable from the network. However, the network of various assets and information has also caused a variety of security problems. SQL injection is a kind of network attack technology with low difficulty, high frequency of occurrence and quick update of technology. Its main harm includes the leakage of user information, the acquisition of system authority and the tampering of web page information. At present, the main defense methods for SQL injection include the security of coding process, the detection system based on program analysis and feature matching, and so on. These defense methods have many problems, such as much information requirement, long development process, high difficulty in deployment and so on. Therefore, this paper proposes a SQL injection detection technique which works in HTTP application layer and detects the potential threat only by analyzing user input without knowing anything about the daemon. The SQL injection detection model proposed in this paper detects user input and outputs threat level by preprocessing, lexical analysis, syntax analysis and machine learning. The features of the SQL detection model are as follows: only user input needs to be extracted, no other background information is needed, the user input is recursively decoded to parse the possible payload as far as possible, and the syntax tree of the sample is abstracted by lexical analysis and syntax analysis. The two machine learning models are set up to verify the result more reliable and can distinguish the threat level and make it easier for users to deal with different levels of attacks. Experimental results show that compared with other SQL injection detection models, this model has higher accuracy and detection efficiency when only collecting user input, and can detect SQL injection attacks effectively.
【学位授予单位】：南京邮电大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.08;TP181

【参考文献】