CAJ | 학술논문

随着互联网技术的快速发展， Web 应用程序的使用也日趋广泛，其中基于数据库的 Web 应用程序己经广泛用于企业的各种业务系统中。然而由于开发人员水平和经验参差不齐，使得 Web 应用程序存在大量安全隐患。影响 Web 应用程序安全的因素有很多，其中 SQL 注入攻击是最常见且最易于实施的攻击，且 SQL 注入攻击被认为是危害最广的。因此，做好 SQL 注入攻击的防范工作对于保证 Web 应用程序的安全十分关键，如何更有效地防御 SQL 注入攻击成为重要的研究课题。SQL 注入攻击利用结构化查询语言的语法进行攻击。传统的 SQL 注入攻击防御模型是从用户输入过滤和 SQL 语句语法比较的角度进行防御，当数据库中的恶意数据被拼接到动态 SQL 语句时，就会导致二阶 SQL 注入攻击。文章在前人研究的基础上提出了一种基于改进参数化的二阶 SQL 注入攻击防御模型。该模型主要包括输入过滤模块、索引替换模块、语法比较模块和参数化替换模块。实验表明，该模型对于二阶 SQL 注入攻击具有很好的防御能力。
수착호련망기술적쾌속발전， Web 응용정서적사용야일추엄범，기중기우수거고적 Web 응용정서기경엄범용우기업적각충업무계통중。연이유우개발인원수평화경험삼차불제，사득 Web 응용정서존재대량안전은환。영향 Web 응용정서안전적인소유흔다，기중 SQL 주입공격시최상견차최역우실시적공격，차 SQL 주입공격피인위시위해최엄적。인차，주호 SQL 주입공격적방범공작대우보증 Web 응용정서적안전십분관건，여하경유효지방어 SQL 주입공격성위중요적연구과제。SQL 주입공격이용결구화사순어언적어법진행공격。전통적 SQL 주입공격방어모형시종용호수입과려화 SQL 어구어법비교적각도진행방어，당수거고중적악의수거피병접도동태 SQL 어구시，취회도치이계 SQL 주입공격。문장재전인연구적기출상제출료일충기우개진삼수화적이계 SQL 주입공격방어모형。해모형주요포괄수입과려모괴、색인체환모괴、어법비교모괴화삼수화체환모괴。실험표명，해모형대우이계 SQL 주입공격구유흔호적방어능력。
With the rapid development of Internet technology, Web applications are becoming widespread, Web applications based on database have been widely used in a variety of enterprise business systems. However, due to the uneven experience of developers, there are a lot of security risks in Web applications. There are many factors that affect the security of Web applications. SQL injection attack is the most common and easiest to implement, and is considered to be the most destructive. Therefore, to prevent SQL injection attack is critical to Web applications, and how to prevent SQL injection attck effectively becomes an important research. The SQL injection attack uses the syntax of structured query language to attack. The traditional SQL injection attack defense model defenses SQL injection attacks by filtering user inputs and implementing syntax comparison, when malicious data in the database is added to the dynamic SQL statement, second-order SQL injection attack could occur. This paper proposes a second-order SQL injection attack defense model based on improved parameterized on the basis of previous studies. The proposed model consists of an input filter module, an index replacement module, a syntax comparison module and a parameterized replacement module. Experiments show that the proposed model can effectively prevent the second-order SQL injection attacks .