面向网络环境的SQL注入行为检测方法  

Approach to detecting SQL injection behaviors in network environment

作　　者：赵宇飞[1] 熊刚[2] 贺龙涛[3] 李舟军[1] 

机构地区：[1]北京航空航天大学计算机学院,北京100083 [2]中国科学院信息工程研究所,北京100093 [3]国家计算机网络应急技术处理协调中心,北京100029

出　　处：《通信学报》2016年第2期88-97,共10页Journal on Communications

基　　金：国家高技术研究发展计划("863"计划)基金资助项目(No.2015AA016004);国家自然科学基金资助项目(No.61170189;No.61370126);教育部博士点基金资助项目(No.20111102130003);国家科技支撑计划基金资助项目(No.2012BAH46B02;No.2012BAH46B04);中国科学院战略性先导科技专项课题基金资助项目(No.XDA06030200)~~

摘　　要：SQL注入攻击是Web应用面临的主要威胁之一,传统的检测方法针对客户端或服务器端进行。通过对SQL注入的一般过程及其流量特征分析,发现其在请求长度、连接数以及特征串等方面,与正常流量相比有较大区别,并据此提出了基于长度、连接频率和特征串的LFF(length-frequency-feature)检测方法,首次从网络流量分析的角度检测SQL注入行为。实验结果表明,在模拟环境下,LFF检测方法召回率在95%以上,在真实环境下,该方法也取得较好的检测效果。SQL injection attack is one of the main threats that many Web applications faced with. The traditional detec- tion method depended on the clients or servers. Firstly the process of SQL injection attack was analyzed, and then the dif- ferences between attack traffic and normal traffic in HTTP request length, HTTP connections and feature string were dis- covered. Based on the request length, request frequency and feature string, a new method, LFF （length-frequency-feature）, was proposed to detect SQL injection behaviors from network traffic. The results of experiments indicated that in simula- tion environments the recall of LFF approach reach up to 95%, and in real network traffic the LFF approach also get a good detection result.

关 键 词：WEB安全 SQL注入 网络流量 异常检测 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]