WO2021174870A1

WO2021174870A1 - Network security risk inspection method and system, computer device, and storage medium

Info

Publication number: WO2021174870A1
Application number: PCT/CN2020/122848
Authority: WO
Inventors: 贾凯; 李智宇; 吴其敏; 江杰; 黄雨喆
Original assignee: 平安科技（深圳）有限公司
Priority date: 2020-09-02
Filing date: 2020-10-22
Publication date: 2021-09-10
Also published as: CN112039900B; CN112039900A

Abstract

The present application relates to the field of network security and provides a network security risk inspection method. Said method comprises: monitoring the operation of a target SQL statement on a target database, and recording the operation of the target SQL statement so as to obtain target SQL log data; analyzing the target SQL log data so as to determine whether risk data is present in the target SQL log data; if risk data is present in the target SQL log data, performing loophole inspection on the risk data so as to determine whether loophole data is present in the risk data; if loophole data is present in the risk data, generating loophole information according to the loophole data, reporting the loophole information to a corresponding secure operation platform, and uploading the loophole data and the loophole information to a blockchain. The present application reduces the operation and maintenance cost of network security risk inspection, and enhances the accuracy of loophole inspection identification, the accuracy of network attack identification, and the efficiency of network security risk inspection.

Description

Network security risk detection method, system, computer equipment and storage medium

This application affirms the priority of the Chinese patent application with the application number 202010907584.6 and titled "Network security risk detection method, system, computer equipment and storage medium" filed on September 02, 2020. The entire content of the Chinese patent application is referred to The way is incorporated in this application.

Technical field

The embodiments of the present application relate to the field of network security, and in particular to a method, system, computer equipment, and computer-readable storage medium for detecting network security risks.

Background technique

With the development of network technology, the Internet has been used more and more in all aspects of daily life. At the same time, more Internet security problems have been exposed in the process of network information transmission. In the context of my country's great attention to network security, enterprises have increasingly higher requirements for network security risk detection technology. However, the inventor realized that the current traditional vulnerability detection technology in the industry has always had its advantages and disadvantages, and the pain points of each technical solution are as follows: Static code scanning: more false positives, labor-intensive, and low degree of automation. Active crawler scanning: large business impact, low detection depth, manual task deployment, and low automation. Passive scanner: Some vulnerability detection has a great impact on the business, and some scenarios have false positives. IAST Scan (RASP): Large-scale deployment is difficult, maintenance costs are high, application support is required, and coupling is high. Among them, IAST scanning and RASP protection technology are the most popular security detection technologies in the past two years. Based on bytecode technology, the application execution stack is detected within the application, which can achieve almost zero false positives of vulnerabilities. However, in the actual application of enterprises, it is necessary to deploy a security agent in each application server. In the environment of tens of thousands of application servers in the enterprise, the promotion cost and operation and maintenance cost are extremely high. Therefore, how to improve the accuracy of vulnerability detection and identification in the current network security risk detection, and further improve the efficiency of network security risk detection, has become one of the current technical problems that need to be solved urgently.

Summary of the invention

In view of this, it is necessary to provide a network security risk detection method, system, computer equipment, and computer readable storage medium to solve the current low accuracy rate of vulnerability detection and recognition in network security risk detection, low accuracy rate of network attack recognition, and Technical problems such as low efficiency of network security risk detection.

In order to achieve the foregoing objective, an embodiment of the present application provides a network security risk detection method, and the method steps include:

Monitor the operation of the target SQL statement on the target database, and record the operation of the target SQL statement to obtain target SQL log data;

Analyzing the target SQL log data to determine whether there is risk data in the target SQL log data;

If the risk data exists in the target SQL log data, performing vulnerability detection on the risk data to determine whether there is vulnerability data in the risk data; and

If the vulnerability data exists in the risk data, generate vulnerability information according to the vulnerability data, and report the vulnerability information to the corresponding security operation platform.

To achieve the foregoing objective, an embodiment of the present application also provides a network security risk detection system, including:

The monitoring module is used to monitor the operation of the target SQL statement on the target database, and record the operation of the target SQL statement to obtain the target SQL log data; and

The analysis module is used to analyze the target SQL log data to determine whether there is risk data in the target SQL log data;

The risk module is configured to perform vulnerability detection on the risk data if the risk data exists in the target SQL log data to determine whether there is any vulnerability data in the risk data; and

The vulnerability module is used to generate vulnerability information according to the vulnerability data if the vulnerability data exists in the risk data, and report the vulnerability information to the corresponding security operation platform.

In order to achieve the foregoing objective, an embodiment of the present application also provides a computer device, the computer device including a memory, a processor, and computer-readable instructions stored in the memory and running on the processor, the When the computer-readable instructions are executed by the processor, the following steps are implemented:

In order to achieve the foregoing objective, embodiments of the present application also provide a computer-readable storage medium having computer-readable instructions stored in the computer-readable storage medium, and the computer-readable instructions may be executed by at least one processor, So that the at least one processor executes the following steps:

The network security risk detection method, system, computer device, and computer-readable storage medium provided by the embodiments of the present application. In this embodiment, risk analysis is performed on the target SQL log data, and vulnerability detection is performed on the target SQL log data that is at risk. , In order to achieve rapid vulnerability data location, reduce the high operation and maintenance cost of network security risk detection, and improve the accuracy rate of vulnerability detection and identification, the accuracy rate of network attack recognition and the efficiency of network security risk detection.

Description of the drawings

FIG. 1 is a schematic flowchart of a method for detecting a network security risk according to an embodiment of this application.

2 is a schematic diagram of program modules of Embodiment 2 of the network security risk detection system of this application.

FIG. 3 is a schematic diagram of the hardware structure of the third embodiment of the computer equipment of this application.

Detailed ways

In order to make the purpose, technical solutions, and advantages of this application clearer and clearer, the following further describes the application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the application, and are not used to limit the application. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art without creative work shall fall within the protection scope of this application.

It should be noted that the descriptions related to "first", "second", etc. in this application are only for descriptive purposes, and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of indicated technical features . Therefore, the features defined with "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on what can be achieved by a person of ordinary skill in the art. When the combination of technical solutions is contradictory or cannot be achieved, it should be considered that such a combination of technical solutions does not exist. , Is not within the scope of protection required by this application.

In the following embodiments, the computer device 2 will be used as the execution subject for exemplary description.

Example one

Referring to FIG. 1, it shows a flowchart of steps of a method for detecting a network security risk according to an embodiment of the present application. It can be understood that the flowchart in this method embodiment is not used to limit the order of execution of the steps. The following exemplarily describes the computer device 2 as the execution subject. details as follows.

In step S100, the operation of the target SQL statement on the target database is monitored, and the operation of the target SQL statement is recorded to obtain target SQL log data.

The computer device 2 can inject an agent (software of autonomous activities) into the application corresponding to the target database to monitor the target database through the agent and record the operation function (target SQL statement) of the target database. Operation information to obtain target SQL log data (Sql log), the target SQL log data includes: application ID, IP address, request interface address, request input parameters, SQL statement, SQL param (tag).

In some embodiments, the computer device 2 may hook (data pull) the operation function of the target database corresponding to the target application that needs security monitoring through the agent, and the target application may be jdbc.Statementlmpl, jdbc of the java application. .PreparedStatement, pdo::query, pdo::exec and so on for php applications. The computer device 2 can manage the operation function of the target database, and the monitoring agent can get all the SQL statements that finally enter the target database to operate, and form a sql log record (target SQL log data). The target SQL log data Can include: application ID, IP address, request interface address, request input parameters, SQL statement, sqlparam and other information, (such as: {"appid": "xxxx", "ip": "192.168.1.100", "source": "URL:/xxx/abc/custInfo.do", "sql":"select*from t_user where username = ?", "sqlparam":"username=zhangsan"}) synchronize the data to the security analysis platform. The sqlparam is the SQL tag <sql:param> tag is used to set the parameter value in the SQL statement. For example, the <sql:param> tag can be used as a nested tag for <sql:update> and <sql:query> to provide values in SQL query parameters.

Step S102: Analyze the target SQL log data to determine whether there is risk data in the target SQL log data.

Exemplarily, the target SQL statement includes a compiled SQL statement and a spliced SQL statement; the step S102 may include steps 200 to 204, wherein: step 200, it is determined whether the target SQL statement is a compiled SQL statement or the Spliced SQL statement; step 202, if the target SQL statement is the compiled SQL statement, there is no risk data in the target SQL log data; and step 204, if the target SQL statement is the spliced SQL Statement, the target SQL log data contains risk data.

The target SQL statement corresponding to the target SQL log data includes a compiled SQL statement and a spliced SQL statement.

In an exemplary embodiment, the computer device 2 can determine whether the target SQL log data is at risk by analyzing whether the SQL statement is a compiled SQL statement or a spliced SQL statement. in:

The compiled SQL statement is a SQL statement in which sqlparam is replaced by "?"; for example, using pre-compiled sql: select username from t_user where userid =? , Which is the SQL statement that is normally pre-compiled and processed. When this SQL enters jdbc, its sqlparam is a "?" placeholder, and there is no risk of SQL injection.

The spliced SQL statement is a SQL statement for the complete application to execute SQL; for example, using spliced SQL: select username from t_user where userid = ‘002’, the param of the spliced SQL statement directly displays the value of the input parameter, this is the risk of SQL injection.

In some embodiments, the computer device 2 may also preliminarily screen applications and interfaces that may have a risk of SQL injection based on other information (such as appid, source, etc.) in the target SQL log data.

Step S104: If the risk data exists in the target SQL log data, perform vulnerability detection on the risk data to determine whether there is any vulnerability data in the risk data.

In some embodiments, the existence of the spliced SQL statement does not mean that its param has a user entry. There may also be some SQL or scheduled SQL running batch tasks executed inside the application. This type of SQL does not have a user entry. There is no risk of injection. Therefore, it is necessary to design some detection logic to determine whether there are loopholes in the interface of splicing SQL, in order to locate the vulnerable data.

Exemplarily, the step S104 may include steps 300 to 302, wherein: step 300 is to perform mark identification detection on the risk data; and step 302, if there is a mark identification in the risk data, the target SQL log Vulnerability data exists in the data.

The computer device 2 may detect the target SQL log data to determine whether the target SQL log data has a pre-inserted mark identifier, and if there is a mark identifier in the target SQL log data, the target can be confirmed There are loopholes in the SQL log data. If the mark identifier does not exist in the target SQL log data, the target SQL log data is safe data.

In an exemplary embodiment, the computer device 2 can perform packet detection on all external interfaces of applications (a passive scanner mechanism can be used), and insert a mark flag for the detected interface parameters, such as the parameter name=tom, insert Special string for injection bit identification, such as name=tommarkedbyscanner. Among them, the security analysis link of the target SQL log data (Sql log) only needs to detect whether there is a markedbyscanner string in the sqlparam or sql statement. If it exists, it can be judged that there is injection, because the SQL statement of the interface uses the splicing method, and there is a user entry (because the sender traffic comes from the user), the parameters brought in by the user request normally enter the sql execution function of jdbc. It can be confirmed that the vulnerability must exist.

Exemplarily, the step S104 may include steps 400 to 402, wherein: in step 400, the risk data is detected by an incoming reference pair; and step 402, if the incoming reference pair is unsuccessful, the target SQL Vulnerability data exists in the log data.

The computer device 2 may obtain the interface input parameter value of the request interface of the target database, and compare the interface input parameter value with the param value of sqlparam in the target SQL log data; if the interface input parameter If the value is inconsistent with the param value, it can be confirmed that there are loopholes in the target SQL log data; if the interface input parameter value is consistent with the param value, the target SQL log data is secure data.

In an exemplary embodiment, the input reference pair detection is used in a vulnerability detection scenario, and the input parameter value of the request interface needs to be compared with the value of sqlparam. If the comparison results are completely consistent, it is determined that the interface meets The conditions of sql injection do not need to verify the mark detection logic; it can also be used in security attack monitoring scenarios, by obtaining the requested input parameters (excluding text type data), and parse the input elements of the input parameters (string, space, special Characters are all one element), if the number of input parameter elements is found to be greater than 1, and the input parameter enters the jdbc execution function as sqlparam, it can be judged that there is a loophole and there is a real attack. This attack detection mechanism can achieve zero errors Report, and the detection efficiency is extremely efficient.

Exemplarily, the step S104 may include steps 500 to 502, wherein: step 500, blacklist detection is performed on the risk data; and step 502, if blacklist data exists in the risk data, the target SQL Vulnerability data exists in the log data.

The computer device 2 may check the requested input parameters in the target SQL log data to determine whether there is an attack payload in the requested input parameters, and if there is an attack payload in the requested input parameters, it can confirm the There are loopholes in the target SQL log data; if there is no attack payload in the request input parameter, the target SQL log data is secure data.

In an exemplary embodiment, the principle of the blacklist check logic is the same as that of WAF, and it is determined whether there is an attack behavior by checking whether there is an attack payload in the input parameters. But the difference between it and WAF is that WAF judges whether the attacker's payload is successfully executed by checking the HTTP request/response in the communication link. However, based on the difference in real scenarios, this detection method often has many in practice. False alarms require manual verification. In addition, the blacklist detection position in this solution is already at the end of the application stack, so entering the blacklist of the sql statement to attack the payload will definitely be executed by the database, which can confirm the existence of real attacks and security vulnerabilities. At present, the detection logic of SQL blacklist is mainly divided into two categories. One is attack keyword detection, which monitors common attack keywords: information_schema, load_file, sleep, and so on. Of course, there will be some false positives in this category. The second is to analyze the special characters in the SQL statement. For example, the total number of single quotes in a complete SQL is an odd number. This type of vulnerability testing is usually performed by the attacker during the attack, which can accurately determine the presence of an attack.

Step S106: If the vulnerability data exists in the risk data, generate vulnerability information according to the vulnerability data, and report the vulnerability information to the corresponding security operation platform.

When the computer device 2 finds a loophole in the target SQL log data, the system corresponding to the target database has loopholes. At this time, the computer device 2 can generate a corresponding loophole information according to the loophole data, and The vulnerability information is reported to the corresponding security operation platform, so that after receiving the vulnerability information, the external party can repair the vulnerability of the system corresponding to the target database according to the vulnerability information.

In this embodiment, the computer device 2 monitors the operation of the target SQL statement on the target database, and performs security monitoring on the target SQL log data to determine the vulnerability data, which can achieve the highest vulnerability detection accuracy rate and network attack identification in the industry. The accuracy rate can achieve almost no false positives; its detection idea is different from the strong dependence of IAST and RASP on the deployment of agents, bypassing the difficulty of deploying security agents, weak compatibility, and huge maintenance costs, but it can achieve the same detection Effect: By applying the agent of the monitoring platform based on bytecode technology, rapid large-scale deployment can be realized, and it can be quickly rolled out in the enterprise without the pressure of operation, maintenance and promotion. In addition, this embodiment can also realize the integrated features of scanning and detection, and at the same time achieve extensive coverage of IAST and RASP capabilities in the enterprise, and combined with the existing security operation mechanism, can achieve in-depth and three-dimensional management of security risks.

Exemplarily, the network security risk detection method further includes; if the vulnerability data does not exist in the risk data, then the target SQL log data is security data.

If the computer device 2 detects that the vulnerability data does not exist in the risk data, the target SQL log data is security data.

Exemplarily, the network security risk detection method further includes: uploading the vulnerability data and the vulnerability information to a blockchain.

Exemplarily, uploading the vulnerability data and the vulnerability information to the blockchain can ensure its security, fairness and transparency. The blockchain referred to in this example is a new application mode of computer technology such as distributed data storage, point-to-point transmission, consensus mechanism, and encryption algorithm. Blockchain, essentially a decentralized database, is a series of data blocks associated with cryptographic methods. Each data block contains a batch of network transaction information for verification. The validity of the information (anti-counterfeiting) and the generation of the next block. The blockchain can include the underlying platform of the blockchain, the platform product service layer, and the application service layer.

Example two

2 is a schematic diagram of program modules of Embodiment 2 of the network security risk detection system of this application. The network security risk detection system 20 may include or be divided into one or more program modules, and the one or more program modules are stored in a storage medium and executed by one or more processors to complete this application. Realize the above-mentioned network security risk detection method. The program module referred to in the embodiments of the present application refers to a series of computer program instruction segments that can complete specific functions, and is more suitable for describing the execution process of the network security risk detection system 20 in the storage medium than the program itself. The following description will specifically introduce the functions of each program module in this embodiment:

The monitoring module 200 is configured to monitor the operation of the target SQL statement on the target database, and record the operation of the target SQL statement to obtain target SQL log data.

The analysis module 202 is configured to analyze the target SQL log data to determine whether there is risk data in the target SQL log data.

Exemplarily, the target SQL statement includes a compiled SQL statement and a spliced SQL statement; the analysis module 202 is further used to determine whether the target SQL statement is a compiled SQL statement or the spliced SQL statement; if If the target SQL statement is the compiled SQL statement, there is no risk data in the target SQL log data; and if the target SQL statement is the spliced SQL statement, then the target SQL log data has risk data .

The risk module 204 is configured to perform vulnerability detection on the risk data if the risk data exists in the target SQL log data to determine whether there is any vulnerability data in the risk data.

Exemplarily, the risk module 204 is further configured to: perform mark identification detection on the risk data; and if there is a mark identification in the risk data, then there is vulnerability data in the target SQL log data.

Exemplarily, the risk module 204 is further configured to: perform an incoming reference pair detection on the risk data; and if the incoming reference pair is unsuccessful, then there is vulnerability data in the target SQL log data.

Exemplarily, the risk module 204 is further configured to: perform blacklist detection on the risk data; and if there is blacklist data in the risk data, then there is vulnerability data in the target SQL log data.

The vulnerability module 206 is configured to generate vulnerability information according to the vulnerability data if the vulnerability data exists in the risk data, and report the vulnerability information to the corresponding security operation platform.

Exemplarily, the network security risk detection system 20 further includes a security module. If the vulnerability data does not exist in the risk data, the target SQL log data is security data.

Exemplarily, the network security risk detection system 20 further includes an upload module, and the upload module is configured to upload the vulnerability data and the vulnerability information to the blockchain.

Example three

Refer to FIG. 3, which is a schematic diagram of the hardware architecture of the computer device according to the third embodiment of the present application. In this embodiment, the computer device 2 is a device that can automatically perform numerical calculation and/or information processing in accordance with pre-set or stored instructions. The computer device 2 may be a rack server, a blade server, a tower server, or a cabinet server (including an independent server or a server cluster composed of multiple servers). As shown in the figure, the computer device 2 at least includes, but is not limited to, a memory 21, a processor 22, a network interface 23, and a network security risk detection system 20 that can communicate with each other through a system bus.

In this embodiment, the memory 21 includes at least one type of computer-readable storage medium. The readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), random access memory ( RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disks, optical disks, etc. In some embodiments, the memory 21 may be an internal storage unit of the computer device 2, for example, the hard disk or memory of the computer device 2. In other embodiments, the memory 21 may also be an external storage device of the computer device 2, for example, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), and a secure digital (Secure Digital, SD) card, flash card (Flash Card), etc. Of course, the memory 21 may also include both the internal storage unit of the computer device 2 and its external storage device. In this embodiment, the memory 21 is generally used to store the operating system and various application software installed in the computer device 2, for example, the program code of the network security risk detection system 20 in the second embodiment. In addition, the memory 21 can also be used to temporarily store various types of data that have been output or will be output.

The processor 22 may be a central processing unit (Central Processing Unit, CPU), a controller, a microcontroller, a microprocessor, or other data processing chips in some embodiments. The processor 22 is generally used to control the overall operation of the computer device 2. In this embodiment, the processor 22 is used to run the program code or process data stored in the memory 21, for example, to run the network security risk detection system 20, so as to implement the network security risk detection method of the first embodiment.

The network interface 23 may include a wireless network interface or a wired network interface, and the network interface 23 is generally used to establish a communication connection between the computer device 2 and other electronic devices. For example, the network interface 23 is used to connect the computer device 2 with an external terminal through a network, and establish a data transmission channel and a communication connection between the computer device 2 and the external terminal. The network may be an intranet (Intranet), the Internet (Internet), a global system of mobile communication (Global System of Mobile) communicatI/On, GSM), Wideband Code DivisI/On Multiple Access, WCDMA), 4G network, 5G network, Bluetooth (Bluetooth), Wi-Fi and other wireless or wired networks.

It should be pointed out that FIG. 3 only shows the computer device 2 with components 20-23, but it should be understood that it is not required to implement all the components shown, and more or fewer components may be implemented instead.

In this embodiment, the network security risk detection system 20 stored in the memory 21 can also be divided into one or more program modules. The one or more program modules are stored in the memory 21 and are composed of one or more program modules. Are executed by two processors (in this embodiment, the processor 22) to complete the application.

For example, FIG. 2 shows a schematic diagram of program modules for implementing the network security risk detection system 20 according to the second embodiment of the present application. In this embodiment, the network security risk detection system 20 can be divided into a monitoring module 200 and an analysis module. 202. The risk module 204 and the vulnerability module 206. Among them, the program module referred to in the present application refers to a series of computer program instruction segments that can complete specific functions, and is more suitable than a program to describe the execution process of the network security risk detection system 20 in the computer device 2. The specific functions of the program modules 200-206 have been described in detail in the second embodiment, and will not be repeated here.

Example four

This embodiment also provides a computer-readable storage medium. The computer-readable storage medium may be non-volatile or volatile, such as flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX). Memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory , Magnetic disks, optical disks, servers, App application malls, etc., on which computer-readable instructions are stored, and the computer-readable instructions realize corresponding functions when executed by the processor. The computer-readable storage medium of this embodiment is used in the network security risk detection system 20, and the processor executes the following steps:

The serial numbers of the foregoing embodiments of the present application are for description only, and do not represent the superiority or inferiority of the embodiments.

Through the description of the above implementation manners, those skilled in the art can clearly understand that the above-mentioned embodiment method can be implemented by means of software plus the necessary general hardware platform, of course, it can also be implemented by hardware, but in many cases the former is better.的实施方式。

The above are only the preferred embodiments of the application, and do not limit the scope of the patent for this application. Any equivalent structure or equivalent process transformation made using the content of the description and drawings of the application, or directly or indirectly applied to other related technical fields , The same reason is included in the scope of patent protection of this application.

Claims

A network security risk detection method, wherein the method includes:

Monitor the operation of the target SQL statement on the target database, and record the operation of the target SQL statement to obtain target SQL log data;

Analyzing the target SQL log data to determine whether there is risk data in the target SQL log data;

If the risk data exists in the target SQL log data, performing vulnerability detection on the risk data to determine whether there is vulnerability data in the risk data; and

If the vulnerability data exists in the risk data, generate vulnerability information according to the vulnerability data, and report the vulnerability information to the corresponding security operation platform.
8. The network security risk detection method according to claim 1, wherein the target SQL statement includes a compiled SQL statement and a spliced SQL statement;

The analyzing the target SQL log data to determine whether there is risk data in the target SQL log data includes;

Judging whether the target SQL statement is a compiled SQL statement or the splicing SQL statement;

If the target SQL statement is the compiled SQL statement, there is no risk data in the target SQL log data; and

If the target SQL statement is the spliced SQL statement, the target SQL log data contains risk data.
5. The network security risk detection method according to claim 1, wherein said performing vulnerability detection on said risk data to determine whether there is vulnerability data in said risk data comprises:

Perform mark detection on the risk data; and

If there is a mark identifier in the risk data, then there is vulnerability data in the target SQL log data.
5. The network security risk detection method according to claim 1, wherein said performing vulnerability detection on said risk data to determine whether there is vulnerability data in said risk data comprises:

The risk data is tested for reference; and

If the reference entry is unsuccessful, then there is vulnerability data in the target SQL log data.
5. The network security risk detection method according to claim 1, wherein said performing vulnerability detection on said risk data to determine whether there is vulnerability data in said risk data comprises:

Perform blacklist detection on the risk data; and

If blacklist data exists in the risk data, vulnerability data exists in the target SQL log data.
The network security risk detection method according to claim 1, which further comprises;

If the vulnerability data does not exist in the risk data, the target SQL log data is safe data.
The network security risk detection method according to claim 1, further comprising: uploading the vulnerability data and the vulnerability information to a blockchain.
A network security risk detection system, which includes:

The monitoring module is used to monitor the operation of the target SQL statement on the target database, and record the operation of the target SQL statement to obtain the target SQL log data; and

The analysis module is used to analyze the target SQL log data to determine whether there is risk data in the target SQL log data;

The risk module is configured to perform vulnerability detection on the risk data if the risk data exists in the target SQL log data to determine whether there is any vulnerability data in the risk data; and

The vulnerability module is used to generate vulnerability information according to the vulnerability data if the vulnerability data exists in the risk data, and report the vulnerability information to the corresponding security operation platform.
A computer device that includes a memory, a processor, and computer-readable instructions that are stored on the memory and can run on the processor, wherein the computer-readable instructions are implemented when the processor is executed The following steps:

Monitor the operation of the target SQL statement on the target database, and record the operation of the target SQL statement to obtain target SQL log data;

Analyzing the target SQL log data to determine whether there is risk data in the target SQL log data;

If the risk data exists in the target SQL log data, performing vulnerability detection on the risk data to determine whether there is vulnerability data in the risk data; and

If the vulnerability data exists in the risk data, generate vulnerability information according to the vulnerability data, and report the vulnerability information to the corresponding security operation platform.
9. The computer device of claim 9, wherein the computer-readable instructions further implement the following steps when executed by the processor:

The analyzing the target SQL log data to determine whether there is risk data in the target SQL log data includes;

Judging whether the target SQL statement is a compiled SQL statement or the splicing SQL statement;

If the target SQL statement is the compiled SQL statement, there is no risk data in the target SQL log data; and

If the target SQL statement is the spliced SQL statement, the target SQL log data contains risk data.
9. The computer device of claim 9, wherein the computer-readable instructions further implement the following steps when executed by the processor:

Perform mark detection on the risk data; and

If there is a mark identifier in the risk data, then there is vulnerability data in the target SQL log data.
9. The computer device of claim 9, wherein the computer-readable instructions further implement the following steps when executed by the processor:

The risk data is tested for reference; and

If the reference entry is unsuccessful, then there is vulnerability data in the target SQL log data.
9. The computer device of claim 9, wherein the computer-readable instructions further implement the following steps when executed by the processor:

Perform blacklist detection on the risk data; and

If blacklist data exists in the risk data, vulnerability data exists in the target SQL log data.
9. The computer device of claim 9, wherein the computer-readable instructions further implement the following steps when executed by the processor:

If the vulnerability data does not exist in the risk data, the target SQL log data is safe data.
9. The computer device according to claim 9, wherein the computer readable instruction further implements the following step when executed by the processor: uploading the vulnerability data and the vulnerability information to a blockchain.
A computer-readable storage medium, wherein computer-readable instructions are stored in the computer-readable storage medium, and the computer-readable instructions can be executed by at least one processor, so that the at least one processor executes the following step:

Monitor the operation of the target SQL statement on the target database, and record the operation of the target SQL statement to obtain target SQL log data;

Analyzing the target SQL log data to determine whether there is risk data in the target SQL log data;

If the risk data exists in the target SQL log data, performing vulnerability detection on the risk data to determine whether there is vulnerability data in the risk data; and

If the vulnerability data exists in the risk data, generate vulnerability information according to the vulnerability data, and report the vulnerability information to the corresponding security operation platform.
15. The computer-readable storage medium of claim 16, wherein the computer-readable instructions are also executable by at least one processor, so that the at least one processor executes the following steps:

The analyzing the target SQL log data to determine whether there is risk data in the target SQL log data includes;

Judging whether the target SQL statement is a compiled SQL statement or the splicing SQL statement;

If the target SQL statement is the compiled SQL statement, there is no risk data in the target SQL log data; and

If the target SQL statement is the spliced SQL statement, the target SQL log data contains risk data.
The computer-readable storage medium according to claim 16, wherein the computer-readable instructions can also be executed by at least one processor, so that the at least one processor executes the following steps: mark the risk data Logo testing; and

If there is a mark identifier in the risk data, then there is vulnerability data in the target SQL log data.
The computer-readable storage medium of claim 16, wherein the computer-readable instructions can also be executed by at least one processor, so that the at least one processor executes the following steps: the risk data is entered into the parameter Comparison test; and

If the reference entry is unsuccessful, then there is vulnerability data in the target SQL log data.
The computer device of claim 16, wherein the computer-readable instructions further implement the following steps when executed by the processor:

Perform blacklist detection on the risk data; and

If blacklist data exists in the risk data, vulnerability data exists in the target SQL log data.