SQL注入攻击问题与策略分析

SQL注入攻击是一项针对计算机数据库安全方面的攻击行为,随着世界范围内的动态交互性网站形式成为主流,B／S模式的网络服务结构被大多数企业和个人网站所采用,从技术角度来说,网站所使用的程序模块越多,所出现的漏洞几率就越大,遭到攻击的可能性也就越大;从程序员的角度来说,编写代码需要用户输入合法的指令并且通过判断,然而由于SQL注入形式具有较强的隐蔽性,只要通过对SQL语句的巧妙改造,就可以实现非法目的。     

Web项目中的SQL注入问题研究与防范方法

基于B/S模式的网络服务构架技术的应用被普遍采用,许多该类型的应用程序在设计与开发时没有充分考虑到数据合法性校验问题,因此使其在应用中存在安全隐患.在横向比较SQL注入攻击模式的基础之上,分析了SQL注入攻击的特点、原理,并对常用注入途径进行了总结.提出在主动式防范模型的基础上,使用输入验证,sQLserver防御以及使用存储过程替代参数化查询相结合的形式构建出一种有效防范SQL注入攻击的思路和方法.测试结果表明该防范模型具有较高的实用性和安全性.     

RFID系统中两阶段规则的SQL注入攻击防御

SQL注入攻击是RFID系统的一个重要攻击方式,RFID系统的吞吐量较大,因此其防御方案应具有较高的计算效率,对此提出一种基于两阶段规则的SQL注入攻击防御方案。首先,按照合法数据域建立合法规则库;然后,对RFID标签中数据的格式与内容进行检查,对非法字符或内容予以标记并忽略;最终,对中间件中动态生成的SQL请求进行格式与内容的检查,对不符合SQL口令规则的请求进行标记并忽略。试验结果证明,本算法可成功检查并防御目前主要类型的注入攻击,且计算效率极高,同时本算法对二次注入攻击具有免疫性。     

面向RFID系统的SQL注入攻击检测和防御算法

针对RFID系统中传统的SQL注入攻击(SQLIA)检测算法成本较高且检测率较低的问题,提出了一种基于数据完整性策略的SQL注入攻击检测和防御算法。利用数据完整性策略,确保输入数据为强类型、语法正确、在长度边界内、仅包含允许的字符、正确签名数字且数字在范围边界内等约束,以防御SQL注入攻击。通过检测查询是否符合意图符合条件、大小符合条件和标识符符合条件来检测SQL注入攻击。实验结果显示,算法具有较高的执行效率,消耗时间仅为节点序列比对算法的29.7%,仅为快速比对算法的76.0%。算法的检测率比常用的检测工具BSQL Hacker和Pangolin分别高出13.8%和20.6%,表明本算法能够保证正常查询,可有效检测和防御SQL注入攻击。     

SQL注入式攻击与防范

随着互联网的迅速壮大,web应用程序开发已经变成的一个发展的大趋势,但是由于开发技术的不同以及开发人员的素质良莠不齐,导致了程序的安全性频频遭到质疑,经常会爆出网站被攻击的新闻。本文针对常见的SQL注入危害展开讨论,介绍SQL注入的原理,常见的SQL注入类型,以及如何防范SQL注入,并针对几种攻击类型,给出解决的办法。     

Defending recommender systems: detection of profile injection attacks

Collaborative recommender systems are known to be highly vulnerable to profile injection attacks, attacks that involve the insertion of biased profiles into the ratings database for the purpose of altering the system’s recommendation behavior. Prior work has shown when profiles are reverse engineered to maximize influence; even a small number of malicious profiles can significantly bias the system. This paper describes a classification approach to the problem of detecting and responding to profile injection attacks. A number of attributes are identified that distinguish characteristics present in attack profiles in general, as well as an attribute generation approach for detecting profiles based on reverse engineered attack models. Three well-known classification algorithms are then used to demonstrate the combined benefit of these attributes and the impact the selection of classifier has with respect to improving the robustness of the recommender system. Our study demonstrates this technique significantly reduces the impact of the most powerful attack models previously studied, particularly when combined with a support vector machine classifier. This research was supported in part by the National Science Foundation Cyber Trust program under Grant IIS-0430303 and the National Science Foundation IGERT program under Grant DGE-0549489.     

浅谈SQL注入攻击与防范

本文从网络应用程序安全问题出发,详细介绍了SQL注入攻击的基本原理,给出了SQL注入攻击的一个简单举例,在此基础上写出了一个防范SQL注入攻击的实用程序,在实际应用中取得很好的效果。     

Preventing injection attacks with syntax embeddings

Software written in one language often needs to construct sentences in another language, such as SQL queries, XML output, or shell command invocations. This is almost always done using unhygienic string manipulation, the concatenation of constants and client-supplied strings. A client can then supply specially crafted input that causes the constructed sentence to be interpreted in an unintended way, leading to an injection attack. We describe a more natural style of programming that yields code that is impervious to injections by construction. Our approach embeds the grammars of the guest languages (e.g. SQL) into that of the host language (e.g. Java) and automatically generates code that maps the embedded language to constructs in the host language that reconstruct the embedded sentences, adding escaping functions where appropriate. This approach is generic, meaning that it can be applied with relative ease to any combination of context-free host and guest languages.     

一种自定义动态密钥预防DDoS攻击的算法

DDoS攻击表现形式有多种,主要造成后果是导致Web服务器无法提供网络服务,最终造成一系列损失。针对通过某一网页端口进行的DDosS攻击,提出了一种预防算法,自定义动态密钥,并采用自定义算法调用,动态改变被攻击端口处的文件名。该算法使得攻击者无法通过加密后的文件来得到原文件名称,从而达到预防此种DDoS攻击的目的。实验证明,此算法有效。     

基于SQL注入的渗透性测试技术研究

为了提高数据库系统的安全性,及时发现、防范网站中可能存在的SQL注入漏洞,分析了基于SQL注入的渗透性测试技术,在此基础上提出了渗透性测试的原型系统,给出了主要的功能,通过对动网论坛的渗透性测试分析比较了原型系统的效能.实验表明,该原型系统能较好发现系统的SQL注入的脆弱点,从而帮助管理员提升系统的安全性.     

基于SQL注入的渗透测试研究

为了提高数据库系统的安全性,防范利用各种数据库漏洞尤其是SQL注入漏洞对数据库发起的攻击,本文分析了基于SQL注入渗透测试的相关技术和渗透方法,并在此基础上提出一个渗透测试的宏观模型,并给出各模块主要功能和渗透流程。     

网站注入式攻击的原理与防范

网站注入式攻击成为Web应用系统的严重安全隐患。通过该类型攻击,攻击者能非法获得对Web应用程序数据库无限制的访问权限,进而得到企业和网络用户的机密信息,如银行账号、交易数据等,给网络用户和企业造成了巨大损失。通过对注入式攻击途径、动机、流程及原理的分析,结合目前普遍采用的攻击测试方法,提出一些防范方法和措施。采用这些方法和措施可极大限度地减少网站注入攻击的可能性,保护数据库的安全。     

SQL注入攻击及其防范检测技术的研究

该文简要介绍了SQL注入攻击的概念和原理,以及SQL注入攻击的特点和实现过程,并在此基础上叙述了如何检测SQL注入攻击．总结了一般的SQL注入攻击的防范方法并且给出一种自动防范模型。     

防SQL注入攻击的数据库驱动设计与实现

为了预防网络应用程序中的SQL注入攻击,提出了防SQL注入攻击的数据库驱动DDriver的设计方法.通过在应用程序和它下面的关系数据库管理系统之间放置一个安全的数据库驱动来检测SQL注入攻击.该驱动器根据预设的查询语句ID来判断SQL语句是否合法,不依赖应用程序和关系数据库,适用于任何系统.通过实现数据库驱动DDriver,并在两个关系数据库管理系统中测试其性能以及处理时间上的额外开销,验证了DDriver在防SQL注入攻击中的准确性及有效性.     

Data-mining based SQL injection attack detection using internal query trees

Detecting SQL injection attacks (SQLIAs) is becoming increasingly important in database-driven web sites. Until now, most of the studies on SQLIA detection have focused on the structured query language (SQL) structure at the application level. Unfortunately, this approach inevitably fails to detect those attacks that use already stored procedure and data within the database system. In this paper, we propose a framework to detect SQLIAs at database level by using SVM classification and various kernel functions. The key issue of SQLIA detection framework is how to represent the internal query tree collected from database log suitable for SVM classification algorithm in order to acquire good performance in detecting SQLIAs. To solve the issue, we first propose a novel method to convert the query tree into an n-dimensional feature vector by using a multi-dimensional sequence as an intermediate representation. The reason that it is difficult to directly convert the query tree into an n-dimensional feature vector is the complexity and variability of the query tree structure. Second, we propose a method to extract the syntactic features, as well as the semantic features when generating feature vector. Third, we propose a method to transform string feature values into numeric feature values, combining multiple statistical models. The combined model maps one string value to one numeric value by containing the multiple characteristic of each string value. In order to demonstrate the feasibility of our proposals in practical environments, we implement the SQLIA detection system based on PostgreSQL, a popular open source database system, and we perform experiments. The experimental results using the internal query trees of PostgreSQL validate that our proposal is effective in detecting SQLIAs, with at least 99.6% of the probability that the probability for malicious queries to be correctly predicted as SQLIA is greater than the probability for normal queries to be incorrectly predicted as SQLIA. Finally, we perform additional experiments to compare our proposal with syntax-focused feature extraction and single statistical model based on feature transformation. The experimental results show that our proposal significantly increases the probability of correctly detecting SQLIAs for various SQL statements, when compared to the previous methods.     

基于Simhash的SQL注入漏洞检测技术研究

针对传统SQL注入漏洞检测方法准确率和效率无法达到很好平衡的问题,提出了一种基于Simhash文本相似性检测的SQL注入漏洞检测技术。使用特征值来进行网页间的比较,提高了检测的精度与效率,据此设计并实现了一个SQL注入漏洞检测原型系统。实验结果表明,该系统在检测SQL注入漏洞时兼具了准确性与高效性。     

On automated prepared statement generation to remove SQL injection vulnerabilities

Since 2002, over 10% of total cyber vulnerabilities were SQL injection vulnerabilities (SQLIVs). This paper presents an algorithm of prepared statement replacement for removing SQLIVs by replacing SQL statements with prepared statements. Prepared statements have a static structure, which prevents SQL injection attacks from changing the logical structure of a prepared statement. We created a prepared statement replacement algorithm and a corresponding tool for automated fix generation. We conducted four case studies of open source projects to evaluate the capability of the algorithm and its automation. The empirical results show that prepared statement code correctly replaced 94% of the SQLIVs in these projects.     

A statistical unsupervised method against false data injection attacks: A visualization-based approach

To achieve intelligence in the future grid, a highly accurate state estimation is necessary as it is a prerequisite for many key functionalities in the successful operation of the power grid. Recent studies show that a new type of cyber-attack called False Data Injection (FDI) attack can bypass bad data detection mechanisms in the power system state estimation. Existing countermeasures might not be able to manage topology changes and integration of distributed generations because they are designed for a specific system configuration. To address this issue, an unsupervised method to distinguish between attack and normal patterns is proposed in this paper. This method can detect FDI attacks even after topology changes and integration of renewable energy sources. In this method, we assume that injecting false data into the power systems will lead to a deviation in the probability distribution of the state vector from the normal trend. The main phases of the proposed algorithm are: (1) Normalizing the dataset, (2) Adding several statistical measures as the new features to the dataset to quantify the probability distribution of the state vectors, (3) Employing principal component analysis to reduce the dimensionality of the dataset, (4) Visualizing the reduced data for humans and exploiting their creativity to detect attacks, and (5) Locating the attacks using Fuzzy C-means clustering algorithm.The proposed method is tested on both the IEEE 14-bus and IEEE 9-bus systems using real load data from the New York independent system operator with the following attack scenarios: (1) attacks without any topology change, (2) attacks after a contingency, and (3) attacks after integration of distributed generations. Experimental results show that our proposed method is superior to the state-of-the-art classification algorithms in dealing with changes. In addition, the reduced data which is helpful in distinguishing between attack and normal patterns can be fed into an expert system for further improvement of the security of the power grid.