A fine-grained petri model for SQL time-blind injection

Abstract

With the background of severe SQL injection attacks, the existing SQL injection modeling methods cannot reflect the process of SQL injection attacks in a fine-grained manner. Based on the discussion of attack technology, this paper takes SQL time-blind injection as an example to model its process with Petri Net. The validity of the model is verified by quantitative analysis and qualitative analysis. Try to inject 10, 20, 30, 40 and 50 times into target aircraft and Petri Net model respectively. The blind injection time is recorded and compared. The results show that the injection time increases with the increase of injection times. Under the same injection times, the Petri Net model takes less time. The sending time in the token can be set. When the sending time is short, the injection speed is fast, and super real-time simulation can be realized, which can realize the rapid prediction of attacks and resource vulnerability effects. When the sending time is long, the injection process slows down. It is beneficial to observe the details of the injection process and whether conflicts occur at a fine-grained level, analyze the purpose of the attack and achieve the purpose of building a patch model. The patch model can effectively take countermeasures against attacks, predict unknown vulnerabilities and ensure network information security.