本文已被：浏览 2161次 下载 2496次
Received:April 16, 2017 Revised:May 02, 2017
Received:April 16, 2017 Revised:May 02, 2017
中文摘要: 针对Web安全中的SQL注入问题，提出了一种新的SQL注入过滤方法——LFS （length-frequency-SQL syntax tree）过滤方法. LFS方法包括学习和过滤两个阶段，其中，学习阶段在安全的环境下，通过爬虫和数据库代理构建URL和SQL语句映射表；过滤阶段通过对URL长度、访问频率及SQL语法树这三个方面进行检测，以此实现对用户输入进行过滤，防止SQL注入攻击. 仿真实验及结果分析表明LFS方法相较于传统的关键字过滤和正则表达式过滤能够更有效的防止SQL注入攻击.
Abstract:To solve the SQL injection problem in the Web security, a new SQL injection filtering method named LFS (length-frequency-SQL syntax tree) is proposed in this study. The LFS includes two phases: the learning and the filtering phase. In the learning phase, the URL and the SQL statement mapping table are built based on the crawler and the database agent in a secure environment. In the filtering phase, the URL length, the access frequency, and the SQL syntax tree are detected to filter the user input to prevent SQL injection attacks. Simulation experiments and results analysis denote that the proposed LFS method can prevent SQL injection attacks more effectively than the traditional keyword filtering and regular expression filtering methods.
文章编号： 中图分类号： 文献标志码：
基金项目:国家自然科学基金（61363068，61472083）；福建省引导基金（2016Y0031）；福州市科技局基金（2015-G-54，2015-G-84）
引用文本：
韩宸望,林晖,饶绪黎,黄川.基于代理模式的SQL注入过滤方法.计算机系统应用,2018,27(1):98-105
HAN Chen-Wang,LIN Hui,RAO Xu-Li,HUANG Chuan.SQL Injection Filtering Method Based on Proxy Mode.COMPUTER SYSTEMS APPLICATIONS,2018,27(1):98-105
韩宸望,林晖,饶绪黎,黄川.基于代理模式的SQL注入过滤方法.计算机系统应用,2018,27(1):98-105
HAN Chen-Wang,LIN Hui,RAO Xu-Li,HUANG Chuan.SQL Injection Filtering Method Based on Proxy Mode.COMPUTER SYSTEMS APPLICATIONS,2018,27(1):98-105
