基于静态分析的Java源代码SQL注入检测算法  

A Java source-code SQL injection attack detection algorithm based on static analysis

作　　者：陈丰 余芸 

机构地区：[1]南方电网公司信息部,广东广州510623

出　　处：《电子技术应用》2013年第4期137-140,共4页Application of Electronic Technique

摘　　要：研究了常见的SQL注入检测和源代码静态分析扫描的原理,提出Java源代码SQL注入检测算法,该算法通过对Java源代码词法分析和语法分析、建立抽象语法树、定义规则、遍历语法树和跟踪等,检测Java源代码中可能的SQL注入路径,测试结果表明,算法检测效果良好,识别率高。This paper researches the method of SQL injection attack detection and the principle of static analysis scanning, and presents a Java source-code SQL injection attack detection algorithm. The detection algorithm includes these steps： lexical analysis of source code, parsing of source code, constructing abstract syntax tree of source code, defining rules, abstract syntax tree traver-sal, tracking problems, detecting possible paths of SQL injection attack etc. Test results show that the proposed detection algorithm performs perfectly and has higher recognition rate.

关 键 词：静态分析 SQL注入 抽象语法树 

分 类 号：TP309.5[自动化与计算机技术—计算机系统结构]