基于语义分析的SQL注入行为检测方案研究  

Research on SQL injection behavior detection scheme based on semantic analysis

作　　者：曹鹏飞[1] 潘绪超 王凡 潘晓峰 包婷婷 Cao Pengfei;Pan Xuchao;Wang Fan;Pan Xiaofeng;Bao Tingting(College of Computer Science and Engineering, Sanjiang University, Nanjing, Jiangsu 210012, China)

机构地区：[1]三江学院计算机科学与工程学院

出　　处：《计算机时代》2019年第11期18-22,共5页Computer Era

基　　金：江苏省普通高校自然科学研究资助项目（17KJD520007）;国家级大创研究项目（201811122006、201911122001Z）

摘　　要：目前SQL注入攻击已成为Web安全领域中最为常见的攻击方式,SQL注入攻击可以泄露用户信息,获取系统权限和篡改网页信息等。文章设计了基于语义分析的SQL注入行为检测方案,能够对攻击行为从语义的角度进行检测。该方案包括数据预处理,抽象语法树,语义分析等功能模块,针对漏洞相关语言的编译器,通过对攻击者输入的内容串进行语法语义检查来判断该请求的恶意程度,理解攻击者意图,能实现对SQL注入攻击的精准识别。At present, SQL injection attack has become the most common attack mode in the field of Web security. SQL injection attack can reveal user information, obtain system privileges and tamper with Webpage information. This paper designs a SQL injection behavior detection scheme based on semantic analysis, which can detect attack behavior from the semantic point of view.The function modules of the scheme include data preprocessing, abstract grammar tree and semantic analysis etc. For the compiler of vulnerability-related languages, the malicious degree of the request can be judged by checking the grammatical semantics of the attacker’s input content strings, and the attacker’s intention can be understood. It can realize the accurate identification of SQL injection attacks.

关 键 词：SQL注入 WEB攻击 语法分析 语义分析 

分 类 号：TP399[自动化与计算机技术—计算机应用技术]