基于AOP与SQL结构分析的SQLIAs动态检测及防御  

Dynamic Detection and Defense of SQLIAs Based on AOP and SQL Structure Analysis

作　　者：何成万[1] 青旺 徐雅琴[1] 严柯[1] HE Chengwan;QING Wang;XU Yaqin;YAN Ke(School of Computer Science and Engineering,Wuhan Institute of Technology,Wuhan 430205,China)

机构地区：[1]武汉工程大学计算机科学与工程学院,武汉430205

出　　处：《计算机工程》2018年第4期154-160,共7页Computer Engineering

基　　金：国家自然科学基金(61272115;60873024)

摘　　要：SQL注入攻击(SQLIAs)是一种危险且有效的基于Web的攻击方式。任何形式的SQLIAs最终都会改变原有SQL语句的逻辑结构,针对该攻击特征,提出一种基于AOP与SQL语句结构分析的SQLIAs动态检测及防御方法,在SQLIAs产生根源对其进行防御。借助代码静态分析工具自动获取SQL注入点位置、Signature信息以及静态SQL语句模型,使用AOP技术在程序执行过程中动态捕获需要被执行的SQL语句,将静态分析得到的信息与动态获取的信息进行比较,判断是否存在SQLIAs。通过简单的用户登录功能验证该方法的有效性,实验结果表明,该方法能有效检测和防御SQLIAs。The SQL Injection Attacks(SQLIAs)is a dangerous and effective Web-based attacks way.According to the characteristics of SQLIAs,that is,any form of attacks will eventually change the logical structure of SQL statement,a method of dynamic detection and defense for the SQLIAs based on Aspect-Oriented Programming(AOP)and the analysis of SQL statement structure is proposed,which can defend against SQLIAs from the root of the attack.Firstly,obtain the location of SQLIAs,signature,and the static SQL statement model automatically by using code Analyzer.Then,capture the executed SQL statement dynamically by using AOP during the process of program execution.Finally Judge whether there is a SQLIAs by making the information obtained by static analysis compare with the dynamic information.The effectiveness of the method is verified by a simple user login function,and the experimental results show that the proposed method can detect and defend the SQLIAs effectively.

关 键 词：SQL注入攻击 面向方面编程 攻击特征 动态检测 逻辑结构 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]