拟态数据库的网络攻击抵御能力评估和实证  

EVALUATION AND DEMONSTRATION OF NETWORK ATTACK RESISTANCE OF MIMETIC DATABASE

作　　者：万仕贤 赵瑜 吴承荣[1] Wan Shixian;Zhao Yu;Wu Chengrong(Engineering Research Center of Network Information Security,Ministry of Education,Fudan University,Shanghai 200433,China)

机构地区：[1]复旦大学网络信息安全审计与监控教育部工程研究中心,上海200433

出　　处：《计算机应用与软件》2022年第1期319-327,共9页Computer Applications and Software

基　　金：国家重点研发计划项目(2017YFB0803203)。

摘　　要：在复杂的网络环境中Web数据库面临诸多威胁和挑战。在传统数据库防护技术的基础上,提出一种基于动态异构冗余体系的拟态数据库应用。针对动态异构冗余的拟态数据库模型进行攻击抵御能力实证评估。重点针对拟态数据库的表决器部分进行评估和实验,从不利用软件漏洞的基础出发,使用应用软件的字符处理特性机制来完成攻击实验。论证得出在满足"共谋攻击"的条件下或者在掌握了一定数量的异构体应用漏洞信息的情况下,针对异构体的语义识别差异构造信息输出,可以实现敏感信息从表决器的多模裁决中逃逸,削弱系统设计的理论安全性。Web database faces many threats and challenges in the complex network environments.On the basis of traditional database protection technology,we propose a mimic database application based on dynamic heterogeneous redundancy system.It conducted an empirical evaluation of the attack resistance for the dynamic heterogeneous redundant mimic database model.We focused on the evaluation and experiment for the voter of the mimic database.We applied the character processing characteristic mechanism of the application software to complete the attack experiment without using the software vulnerabilities.It is demonstrated that under the conditions of"collusion attack"or mastering a certain amount of application vulnerability information of isomer,constructing information output based on the semantic recognition differences of the isomers can achieve the escape of sensitive information from the multi-mode ruling of the voter and weaken the theoretical security of system design.

关 键 词：拟态数据库 动态异构冗余 SQL注入 表决器 数据库语法 防御评估 

分 类 号：TP3[自动化与计算机技术—计算机科学与技术]