一种基于少量异常标签的SQL注入攻击检测方法

A SQL injection attack detection method based on a few abnormal labels

摘要:

SQL注入攻击通过入侵目标数据库实现对数据的窃取或破坏，危害性极大.SQL注入攻击检测可帮助及时发现潜在的安全威胁，从而有利于数据库安全防护.然而在智能交通系统中，由于其内部的复杂性和SQL注入攻击新变种的不断涌现，可供机器学习模型训练的异常标签样本往往较少，使得现有大多数SQL注入攻击检测方法容易存在模型过拟合和性能退化的问题.针对上述问题，本文综合考虑智能交通系统和SQL注入攻击的特点，设计了一种基于比特编码的SQL注入攻击检测框架.该框架无需预训练词嵌入模型和进行语法规则解析.基于该框架，本文提出基于注意力机制的半监督SQL注入攻击检测模型(ASDM).该模型首先通过重构数据样本，学习样本特征的中心趋势和离散程度等高层次特征，表达特征后验分布和特征偏离程度；接着将该高层次特征与数据编码特征融合，突出不同类别数据间的差异；最后引入注意力机制和残差网络构造检测器输出判定结果，以使模型能够根据重要程度对特征施加不同的关注力度，同时具有较强的泛化能力.实验结果表明：本文方法在数据标签不平衡的情况下，相较于其他SQL注入攻击检测方法具有更优的检测性能；并能够检测未知SQL注入攻击.

Abstract:

SQL injection attacks would cause significant harm because they can steal or destroy data by intruding target database. SQL injection attack detection can find out the potential security threat in time, and it is beneficial to the database security protection. However, in intelligent transportation system, due to its internal complexity and the emergence of new varieties of SQL injection attacks, the size of abnormal samples cannot meet the requirement of machine learning model training. This would carry a significant risk of model overfitting and performance degradation. In order to solve the problem, a SQL injection attack detection framework is designed based on bit coding, considering the characteristics of intelligent transportation systems and SQL injection attacks comprehensively. In the framework, pre-training word embedding model and parsing of grammatical rules are not needed. Then, a semi-supervised SQL injection attack detection model (ASDM) is proposed based on this framework, combined with the attention mechanism. In the model, the samples are reconstructed to learn the high-level features(such as the central trend and the dispersion degree of the features) and to express the feature posterior distribution and feature deviation. Then, these high-level features are fused with the data coding features to highlight the differences between different types of data. Finally, the attention mechanism and residual network are introduced to construct the detector, with the aim of exerting different attention intensity to the features according to their importance degree and guaranteeing the generalization ability of the model. The experimental results show that the proposed method has better detection performance compared with other SQL injection attack detection methods for the data with unbalanced labels, and can detect unknown SQL injection attacks.