论文标题
与机器学习的协作SQL注射检测系统
Collaborative SQL-injections detection system with machine learning
论文作者
论文摘要
数据挖掘和从数据中提取的信息提取是一个近年来与基于人工智能以及机器和深度学习使用的技术相关的领域。本工作的主要目的是基于先前对安全审计工具的行为研究（针对SQL pentesting）开发工具，目的是创建能够对SQL攻击进行准确检测的测试集。该研究基于在塞五个实验室环境中通过生成的Web服务器日志收集的信息。然后，利用日志中的常见提取模式，每个攻击向量都被分类为风险水平（危险攻击，正常攻击，非攻击等）。最后，进行了对生成数据的培训，以获取一个分类器系统，该分类器系统在阳性攻击检测中的性能在97％至99％之间。培训数据与其他服务器共享，以创建一个分布式网络，能够确定查询是攻击还是真正的请愿书，并告知连接的客户，以阻止攻击者IP的请愿书。
Data mining and information extraction from data is a field that has gained relevance in recent years thanks to techniques based on artificial intelligence and use of machine and deep learning. The main aim of the present work is the development of a tool based on a previous behaviour study of security audit tools (oriented to SQL pentesting) with the purpose of creating testing sets capable of performing an accurate detection of a SQL attack. The study is based on the information collected through the generated web server logs in a pentesting laboratory environment. Then, making use of the common extracted patterns from the logs, each attack vector has been classified in risk levels (dangerous attack, normal attack, non-attack, etc.). Finally, a training with the generated data was performed in order to obtain a classifier system that has a variable performance between 97 and 99 percent in positive attack detection. The training data is shared to other servers in order to create a distributed network capable of deciding if a query is an attack or is a real petition and inform to connected clients in order to block the petitions from the attacker's IP.
