Research on the SQL injection filtering based on SQL syntax tree

Chen-wang HAN; Hui LIN; Chuan HUANG

doi:10.11959/j.issn.2096-109x.2016.00113

您当前的位置：

首页 >

文章列表页 >

Research on the SQL injection filtering based on SQL syntax tree

Papers | 更新时间：2024-06-03

- Research on the SQL injection filtering based on SQL syntax tree
- Chinese Journal of Network and Information Security Vol. 2, Issue 11, Pages: 70-77(2016)
- 作者机构：
  
  1. 福建师范大学数学与计算机科学学院，福建福州 350117
  2. 福建师范大学福建省网络安全与密码技术重点实验室，福建福州 350117
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2016.00113
  CLC： TP309
- Online First：2016-11，
  
  Published：15 November 2016
- 稿件说明：
移动端阅览
Chen-wang HAN, Hui LIN, Chuan HUANG. Research on the SQL injection filtering based on SQL syntax tree[J]. Chinese Journal of Network and Information Security, 2016, 2(11): 70-77.
DOI：

Chen-wang HAN, Hui LIN, Chuan HUANG. Research on the SQL injection filtering based on SQL syntax tree[J]. Chinese Journal of Network and Information Security, 2016, 2(11): 70-77. DOI： 10.11959/j.issn.2096-109x.2016.00113.

摘要

Web 应用的发展，使其涉及的领域也越来越广。随之而来的安全问题也越来越严重，尤其是 SQL注入攻击，给Web应用安全带来了巨大的挑战。针对SQL注入攻击，将基于SQL语法树比较的安全策略引入用户输入过滤的设计中，提出了一种新的SQL注入过滤方法。实验结果表明，该方法能够有效地防止SQL注入攻击，并有较高的拦截率和较低的误报率。

Abstract

The development of Web application make its areas become more and more widely.Followed by a security problem is becoming more and more serious

especially for the SQL injection attacks

which bring a huge challenge to the Web application security.A new SQL injection filtering method was proposed to detect SQL injection attack by introducing a security strategy based on SQL syntax tree to the design of the user input filtering.The experimental results show that the method can effectively prevent SQL injection attacks

and has higher recognition rate and lower rate of false positives.

关键词

Keywords

references

郑成兴 . 网络入侵防范的理论与实践 [M ] . 北京 : 机械工业出版社 , 2006 .

ZHENG C X . Network intrusion prevention theory and practice [M ] . Beijing : China Machine PressPress , 2006 .

高鹏 , 严望佳 . 构建安全的 Web 站点 [M ] . 北京 : 清华大学出版社 , 1999 .

GAO P , YAN W J . Build a secure Web site [M ] . Beijing : Tsinghua University PressPress , 1999 .

ANLEY , Chris . Advanced SQL injection in SQL server applications [R ] . An NGSSoftware Insight Security Research (NISR) Publication , 2002 .

CLARKE J . SQL Injection Attacks and Defense [M ] . Amsterdam : ElsevierPress , 2009 .

李鑫 , 张维纬 , 隋子畅 , 等 . 新型SQL注入及其防御技术研究与分析 [J ] . 信息网络安全 , 2016 , 2 : 66 - 73 .

LI X , ZHANG W W , SUI Z C , et al . Research and analysis on the novel SQL injection and defense technique [J ] . Netinfo Security , 2016 , 2 : 66 - 73 .

BECHER M . Web application firewalls [D ] . Akademikerverlag:Universiti Teknologi MARA , 2012 .

ROESCH M , . Snort:lightweight intrusion detection for networks [C ] // The 13th Conference on Systems Administration (LISA-99),Usenix Association . 1999 : 229 - 238 .

MI-YEON K , DONG H L . Data-mining based SQL injection attack detection using internal query trees [J ] . Expert Systems with Applications , 2014 ( 41 ): 5416 - 5430 .

石聪聪 , 张涛 , 余勇 , 等 . 一种新的SQL注入防护方法的研究与实现 [J ] . 计算机科学 , 2012 ,( S1 ): 60 - 64 .

SHI C C , ZHANG T , YU Y , LIN W M . New approach for SQL-injection detection [J ] . Computer Science , 2012 ,( S1 ): 60 - 64 .

成晓利 . Web 应用程序SQL 注入攻击漏洞测试系统的研究与实现 [D ] . 成都:西南交通大学 , 2013 .

CHENG X L . Research and implementation of Web application SQL injection vulnerability detection system [D ] . Chengdu:Southwest Jiaotong University , 2013 .

褚龙现 . ASP.NET 应用中SQL注入攻击的分析与防范 [J ] . 计算机与现代化 , 2014 ,( 3 ): 151 - 153 ,160.

CHU L X . Analysis and defense of SQL injection attacks in ASP.NET application [J ] . Computer and Modernization , 2014 ,( 3 ): 151 - 153 ,160.

WEI K , MUTHUPRASANNA M , KOTHARI S . Preventing SQL injection attacks in stored procedures [C ] // IEEE Conference on Piscataway,Software Engineering . 2006 : 191 - 198 .

黄龙军 . 存储过程技术在网络考试系统SQL 注入攻击防御上的应用 [J ] . 计算机系统应用 , 2013 , 22 ( 1 ): 103 - 106 .

HUANG L J . Application of stored procedures to defense against SQL injection attacks in online examination system [J ] . Computer Systems ＆ Applications , 2013 , 22 ( 1 ): 103 - 106 .

杨玉龙 , 彭长根 , 周洲 . 基于同态加密的防止 SQL 注入攻击解决方案 [J ] . 信息网络安全 , 2014 ,( 1 ): 30 - 33 .

YANG Y L , PENG C G , ZHOU Z . A solution of preventing SQL injection attacks based on homomorphic encryption [J ] . Netinfo Security , 2014 ,( 1 ): 30 - 33 .

赵宇飞 , 熊刚 , 贺龙涛 , 等 . 面向网络环境的SQL注入行为检测方法 [J ] . 通信学报 , 2016 , 02 : 88 - 97 .

ZHAO Y F , XIONG G , HE L T , et al . Approach to detecting SQL injection behaviors in network environment [J ] . Journal on Communications , 2016 , 02 : 88 - 97 .

Views

2581

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Web service threat detection method based on traffic interaction graph analysis

Research on link detection technology based on dynamic browser fingerprint

Related Author

Yu Beiyuan

Zeng Guangjie

Peng Hao

Liu Jianwei

Li Hongliang

Tan Xueshi

Fan GAO

Jian WANG

Related Institution

School of Cyber Science and Technology, Beihang University

School of Computer Science and Engineering, Beihang University

Qi An Xin Technology Group Inc

⁰