摘要： SQL注入攻击(SQLIAs)是一种危险且有效的基于Web的攻击方式。任何形式的SQLIAs最终都会改变原有SQL语句的逻辑结构,针对该攻击特征,提出一种基于AOP与SQL语句结构分析的SQLIAs动态检测及防御方法,在SQLIAs产生根源对其进行防御。借助代码静态分析工具自动获取SQL注入点位置、Signature信息以及静态SQL语句模型,使用AOP技术在程序执行过程中动态捕获需要被执行的SQL语句,将静态分析得到的信息与动态获取的信息进行比较,判断是否存在SQLIAs。通过简单的用户登录功能验证该方法的有效性,实验结果表明,该方法能有效检测和防御SQLIAs。

关键词: SQL注入攻击, 面向方面编程, 攻击特征, 动态检测, 逻辑结构

Abstract: The SQL Injection Attacks(SQLIAs) is a dangerous and effective Web-based attacks way.According to the characteristics of SQLIAs,that is,any form of attacks will eventually change the logical structure of SQL statement,a method of dynamic detection and defense for the SQLIAs based on Aspect-Oriented Programming(AOP) and the analysis of SQL statement structure is proposed,which can defend against SQLIAs from the root of the attack.Firstly,obtain the location of SQLIAs,signature,and the static SQL statement model automatically by using code Analyzer.Then,capture the executed SQL statement dynamically by using AOP during the process of program execution.Finally,judge whether there is a SQLIAs by making the information obtained by static analysis compare with the dynamic information.The effectiveness of the method is verified by a simple user login function,and the experimental results show that the proposed method can detect and defend the SQLIAs effectively.

Key words: SQL Injection Attacks(SQLIAs), Aspect-Oriented Programming(AOP), attack characteristic, dynamic detection, logical structure

中图分类号: 

• TP311