TWI579717B - Dynamic Web site HTTP network packet and database packet auditing system and method - Google Patents

Description

HTTP network packet and database packet auditing system and method for dynamic URL

The present invention relates to a HTTP network packet and database packet auditing system and method for dynamic web addresses, and more particularly to an HTTP network packet and database packet auditing system and method for dynamic web addresses using statistical numerical operations.

The popularity and convenience of the Internet has grown rapidly. The Internet has become the mainstream medium for delivering information today, and various companies or hospitals have established their own regional networks.

Since everyone can access and modify data through the Internet, there are many ways to access or modify data through the Internet through illegal means. To this end, the access to data over the Internet must be recorded as a basis for the investigation of the responsibility of the security. However, in the existing Internet, a network server is used for users to connect, and users access the network. The server transmits a Hypertext Transfer Protocol (HTTP) network packet (HTTP request) to access the network data, and the network data provided by the network server is not stored in the network. In the server, it is stored in a data server, and the network server is connected to the data server, and the SQL server is sent to the data server to obtain the network to be provided to the user. Road information.

Taiwan Patent Publication No. I457774 discloses a network packet and database packet auditing system and method, which can calculate a correlation coefficient as a judgment URL by calculating a global resource distribution information and a statistical sample of the SQL database for each time interval. The basis of whether the URL (Uniform Resource Locator) and the SQL database statement are related to each other can replace the complicated and high-computation content comparison step by numerical calculation, thereby greatly reducing the amount of calculation and eliminating the need to store a large amount of packet contents. The correlation learning analysis program can be executed together with the auditing program, and the occurrence of the security vulnerability can be further avoided, and after a certain period of execution (after multiple time intervals), the storage space and the calculation amount can be maintained without being increased. The initially received URL and the SQL database statement are all reflected in the newly calculated correlation coefficient with respect to the time interval distribution, and the accuracy of the judgment can be improved without increasing the amount of calculation.

The above network packet and database packet auditing system and method are used for auditing HTTP network packets of static URLs. The static URL is distinguished by a question mark in the string of the URL, and the word before the question mark. The string is the web path, and the string after the question mark is a variable. The same web page path is the same SQL database description, but the parameters are different. In the static URL, using the statistical method to compare the web page path with the SQL database statement, it means that because there are more than one user at the same time, the higher the number of matches, the higher the relevance, the basic The relationship is judged and counted, and it is found out which web pages are related to which SQL database statements, and an association table is established accordingly. These are all statistical methods that are observed every time (every minute or every five minutes).

However, because many web pages have now been changed to dynamic web pages, dynamic URLs are difficult to distinguish between web page paths or variable values based on question mark symbols. That is, static URLs are distinguished by question mark symbols in the URL string, and strings before the question mark symbol. For web page paths, the way the string after the question mark symbol is changed is not feasible on the dynamic URL because the URL string in the dynamic URL is determined by the website URL (http://www.domain.com) The variable value after the first "/" after the website URL may be a string, a number or a symbol. The string after the first "/" after the website URL of the dynamic URL and the question mark symbol are not all webpage paths, and may be variable values. It is not feasible to use the variable value of the static URL for dynamic URLs. Therefore, the above-mentioned auditing method that only applies to static URLs is not enough for more and more dynamic websites today, because in the dynamic URL, the existing HTTP network packet and database packet auditing system cannot truly Dynamic URLs are patterned. It can be seen that the above method is not applicable to dynamic URLs, and a solution for seeking packet auditing for dynamic URLs is needed.

The purpose of this creation is to provide a method for HTTP network packet and database packet auditing of dynamic URLs. Through the HTTP network packet and database packet auditing method, the shortcomings of the existing auditing method cannot be used for dynamic web pages.

According to the above purpose, the present invention provides a method for HTTP network packet and database packet auditing of a dynamic web address, which comprises the following steps: receiving a plurality of HTTP network packets and a plurality of SQL database packets in a time interval, each The HTTP network packet includes a plurality of first variable values, each of the SQL database packets includes a plurality of second variable values; and each of the first plurality of HTTP network packets included in the time interval is calculated a quantity of variable values; accumulating the quantity of each of the first variable values to a variable quantity accumulation table as a variable statistical hash table; excluding in the SQL database package different from the variable statistical hash table a plurality of second variable values of the first variable value; culling the second variable values that are the same as the first variable value of the variable statistical hash table that exceeds a predetermined threshold value; The second variable value, according to the same first variable value, the second variable value is arranged in the number of the variable statistical hash table from small to large, and the second variable value is at the time Comparing the first variable values of the HTTP network packets in the interval; the second variable values retained by the SQL database packets and the numbers included in the HTTP network packets The variable values are the same, and the HTTP network packets associated with the SQL database packages are found from the first variable values to establish an auditory association between the SQL database packets and the HTTP network packets. table.

Another purpose of this creation is to provide a dynamic web address HTTP packet and database packet auditing system. Through the HTTP network packet and database packet auditing system of the dynamic web address, the variable value of the HTTP network packet can be found, and then It can perform auditing of HTTP network packets and SQL database packets.

According to the above purpose, the present invention provides an HTTP network packet and database packet auditing system, which comprises: an HTTP network packet listener for capturing a plurality of HTTP networks transmitted by a client to a network server. a packet, each of the HTTP network packets includes at least one URL; a SQL database packet listener for capturing a database packet transmitted by the network server to a data server, and each of the packets The database package includes at least one SQL database statement; an associated auditing device, respectively connected to the HTTP network packet listener and the SQL database packet listener, the HTTP network packet listener is full Transmitting the HTTP network packets to the associated auditing device after the plurality of HTTP network packets in the time interval, the SQL database packet packet listener transmitting the SQL after capturing the plurality of SQL database packets in the time interval The database is encapsulated to the associated auditing device, and the associated auditing device includes: a variable statistics module, configured to include the first variables included in the HTTP network packets in the time interval The value is accumulated to a variable quantity accumulation table as a variable statistical hash table; an audit module uses and checks the second variable values included in the SQL database package, and the rejection is different from the variable statistical hash table. The second variable values of the first variable values, and the second variable values that are the same as the first variable values of the variable statistical hash table that exceed a predetermined threshold value, and then the remaining The second variable value finds the HTTP network packets associated with the SQL database statements included in the SQL database package to establish the SQL database package and one of the HTTP network packets. Audit the association table.

Through the creation of HTTP network packet and database packet auditing system and method, it can be applied to dynamic web pages, find valid variable values in dynamic web pages, eliminate invalid variable values, and improve URL and SQL database package The included SQL database describes the accuracy of the correlation, which in turn improves the load on the system.

The technical means adopted by the present invention for achieving the intended purpose of the invention are further explained below in conjunction with the drawings and preferred embodiments of the present invention.

FIG. 1 is a block diagram showing the HTTP network packet and database packet auditing system of the dynamic URL of the creation. As shown in FIG. 1, the HTTP network packet and database packet auditing system 10 of the dynamic URL includes an HTTP network packet listener 11, an SQL database packet listener 12, and an association auditing device 13.

The HTTP network packet listener 11 is used for extracting the HTTP network packet transmitted by the client to the network server, and the HTTP network packet is a network packet of the Hypertext Transfer Protocol (HTTP), and is captured. The HTTP network packet is transmitted to the correlation auditing device 13 after the HTTP network packet of the time interval. Each HTTP network packet contains at least one URL information, and in the URL information of each HTTP network packet, the first "/" after the URL includes a plurality of first variable values. For example, the URL of the dynamic URL (http://www.domain.com/abc/index.php?catID=1&storyID=12245) contains the first section (the website URL section http://www.domain.com /) with the second section (abc/index.php?catID=1&storyID=12245). The second section contains a plurality of first variable values, and the second section is divided into a first sentence (abc/index.php) and a second sentence (catID=1&storyID=12245) according to the distinguishing symbol "?". In the first sentence, the delimited symbol is "/" and the first variable is abc and index.php. In the second sentence, the distinguishing symbol "?" is followed by a plurality of variable arrays, the composition of the variable array is "variable = variable value", and after the identification symbol "=" is a first variable value, the defined symbol between the arrays is changed. It is "&", so 1 and 12245 are the first variable values. The SQL database packet listener 12 is configured to retrieve the data packet of the data database transmitted by the network server to the data server, and transmit the packet to the correlation auditing device 13 after capturing the SQL database packet of the time interval. Each SQL database package contains at least one SQL database statement (SQL query), and each SQL database package contains a plurality of second variable values.

The association auditing device 13 is connected to the HTTP network packet listener 11 and the database packet listener 12, and is configured to receive the HTTP network packet and the SQL database packet in the time interval. The correlation auditing device 13 includes a variable statistic module 131 and an auditing module 132. The variable statistic module 131 can accumulate the number of first variable values included in the HTTP network packet in the time interval to the variable quantity accumulating table. As a variable statistics hash table (Hash Table), also known as URL variable statistics hash table. In addition, the variable statistics module 131 removes the first variable value exceeding the retention time in the variable quantity accumulation table according to the retention time of the variable quantity accumulation table. The retention time is a time interval of a certain fixed interval, which may be 12 hours or 1 day, and is not limited herein. The audit module 132 checks the second variable value included in the SQL database packet, and rejects the second variable value different from the first variable value of the variable statistical hash table, and the number of the hash table and the variable count table exceeds one Setting the second variable value with the same first change value of the threshold value, and then using the remaining second variable value to find the HTTP network packet associated with the SQL database statement included in the SQL database package To establish an audit association table between the SQL database package and the HTTP network packet for auditing personnel to query.

When the HTTP network packet of the dynamic URL of the present creation is compared with the database packet auditing system 10 in the memory, it is avoided that a large amount of storage space is needed to store the content of the HTTP network packet and the SQL database as in the prior art. And using a large amount of computing resources for the content comparison program, further avoiding the complicated calculation of the correlation variables between the URL and the SQL database data in the prior art and the comparison procedure of the URL and the SQL database statement of the high correlation variable, so that the URL The correlation with the SQL database statement is improved, and the load of the operation can be reduced.

2 is a flow chart of an HTTP network packet and database packet auditing method. As shown in FIG. 2, in step S201, a plurality of HTTP network packets and a plurality of SQL database packets in a time interval are received through the HTTP network packet listener and the SQL database packet listener, respectively. The packet includes a plurality of first variable values, and each SQL database packet includes a plurality of second variable values. The time interval represents a time period at a certain fixed interval, which may be 5 minutes or 10 minutes, which is not limited herein. The HTTP network packet is a HTTP network packet of the dynamic URL, and at least one SQL database statement (SQL query) is included in each SQL database package, and the listener 11 is respectively intercepted by the HTTP network in step S201. The SQL database packet listener 12 receives the HTTP network packet and the SQL database packet. Next, in step S202, the number of first variable values included in the HTTP network packet of the time interval is calculated. In the HTTP network packet and database packet auditing method, it is necessary to calculate the number of occurrences of each first variable value in the HTTP network packet, and determine whether the first variable value is based on the number of occurrences of the HTTP network packet according to the first variable value. Is a valid variable value. In step S203, the quantity to a variable quantity accumulation table is accumulated as a variable statistical hash table, and in order to determine whether the second variable value is a valid variable value by the number of the first variable value in the subsequent step, A variable value and the number of first variable values are made into a variable statistical hash table, which may also be referred to as a URL variable statistical hash table. In step S204, a second variable value different from the first variable value of the variable statistical hash table is excluded from the SQL database package. The SQL database package contains many different second variable values, but not all of the second variable values are related to the first variable value of the HTTP network packet, if the second variable included in the SQL database packet The value is different from the first variable value of the variable statistics hash table of the HTTP network packet, which indicates that the second variable value in the SQL database packet is not the second variable value required in the time interval, and can be excluded.

Then, in step S205, the second variable value that is the same as the first variable value of the variable statistical hash table that exceeds a preset threshold value is eliminated, and not each of the plurality of first variable values in the HTTP network packet The first variable value is a valid first variable value. By setting a preset threshold value, the second variable value in the SQL database packet that is the same as the first variable value in the variable statistics hash table is excluded. The first variable value is only the invalid variable value of the dynamic web page, and therefore the second variable value that is the same as the first variable value of the variable statistical hash table that exceeds a preset threshold value is eliminated. In step S206, the second variable value in the SQL database package is arranged according to the number of the first variable values in the variable statistics hash table, and the second variable value is arranged from small to large, and the second variable value is The first variable values of the HTTP network packets in the time interval are compared. In step S207, when the second variable value retained by the SQL database packet is the same as the first variable value included in the HTTP network packet, the first variable value is found to be associated with the SQL database package. The HTTP network packet is used to establish an audit association table of the SQL database packets and the HTTP network packets.

Figure 3 shows the flow chart of the variable statistics program and auditing procedure of the HTTP network packet and database packet auditing method of the present invention. As shown in FIG. 3, in the variable statistics program, in step S301, the HTTP network packet of a time interval is continuously received, and in step S302, the first URL after the website URL of the URL included in each HTTP network packet is received. The items after the "/" are regarded as the first variable value, and in step S303, the number of the first variable values included in the HTTP network packet in a time interval is accumulated to the variable number accumulation table, and then in step S304. The accumulated first variable value and the quantity are used as a variable statistics hash table.

In the auditing process, in step S305, the SQL database packet of a time interval is continuously received, and then each second variable value included in each SQL database packet is checked one by one. In the exclusion procedure of the second variable value included in the SQL database package, in step S306, the first variable value different from the variable statistical hash table is removed from the second variable value included in the SQL database package. The second variable value, and in step S307, the second variable value that is the same as the first variable value of the variable threshold hash table exceeding the preset threshold value is excluded from the second variable value included in the SQL database packet. Then, in step S308, the SQL database is encapsulated by the second variable value of the exclusion program, and the number of the variable statistics hash table is sorted according to the same first variable value from small to large (the second variable value is smaller) , the higher the probability of being represented as a feature variable value, can be used as a basis for judging the relevance of the URL to the SQL database. Then, in S309, the second variable value and the HTTP network packets in the time interval are encapsulated. The first variable values contained are compared. If a second variable value retained by the SQL database packet is the same as a first variable value included in an HTTP network packet, the HTTP data packet corresponding to the second variable value is found and the SQL database is encapsulated. An associated HTTP network packet is created to establish an audit association table.

In the auditing procedure, the second variable value retained for the SQL database packet is sorted from small to large according to the same first variable value in the number of variable statistical hash tables, and the second variable number is the second variable value. The comparison of the variable value with the first variable value causes the general variable value to be excluded by such program execution. The variable statistics program is continuously executed, and the first variable value of the continuously updated variable statistics hash table is compared with the second variable value included in the SQL database packet continuously received by the audit program, and the old data exceeding the retention time is The variable quantity is cleared in the cumulative table.

Through the creation of HTTP network packet and database packet auditing system and method, it can be applied to dynamic web pages, find valid variable values in dynamic web pages, eliminate invalid variable values, and do not need a large amount of storage space to store The content of the HTTP network packet and the SQL database package improves the accuracy of the association between the URL and the SQL database contained in the SQL database package, thereby improving the shortcomings of the traditional audit method that cannot be applied to the dynamic URL.

The above is only a preferred embodiment of the present invention, and is not intended to limit the present invention in any way. Although the present invention has been disclosed above in the preferred embodiments, it is not intended to limit the present invention, and any skilled person skilled in the art. The equivalents of the above-discussed technical content may be modified or modified to equivalent variations, without departing from the spirit and scope of the present invention. Any simple modifications, equivalent changes and modifications made to the above embodiments are still within the scope of the present technical solution.

10‧‧‧ HTTP network packet and database packet auditing system for dynamic URLs
11‧‧‧HTTP network packet listener
12‧‧‧SQL database packet listener
13‧‧‧Related auditing device
131‧‧‧Variable Statistics Module
132‧‧‧ audit module

FIG. 1 is a block diagram showing the HTTP network packet and database packet auditing system of the dynamic URL of the creation. FIG. 2 is a flow chart of the HTTP network packet and database packet auditing method of the dynamic URL of the creation. FIG. 3 shows a flow chart of the variable statistics program and the auditing procedure of the HTTP network packet and the database packet auditing method of the dynamic URL of the present creation.

Claims (8)

A method for HTTP network packet and database packet auditing of a dynamic URL includes the following steps: receiving a plurality of HTTP network packets and a plurality of SQL database packets in a time interval, each of the HTTP network packets including a plurality of a first variable value, each of the SQL database packets includes a plurality of second variable values; calculating a quantity of each of the first variable values included in the HTTP network packets of the time interval; a quantity-to-variable quantity accumulation table as a variable statistical hash table; a plurality of second variable values different from the first variable values of the variable statistical hash table are excluded from the SQL database package; the culling and the variable statistics The second variable value in the hash table that is greater than a preset threshold value and the first variable value is the same; the second variable value in the SQL database packet is in accordance with the same first variable value Arranging the second variable values from the small to largest number of the variable statistics hash table, and the second variable values and the first variable values of the HTTP network packets in the time interval Row alignment; when the second variable values retained by the SQL database packets are the same as the first variable values included in the HTTP network packets, and the second variable values are found The SQL database packet is associated with the HTTP network packets to establish an audit association table of the SQL database packets and the HTTP network packets. The HTTP network packet and the database packet auditing method of the dynamic URL according to claim 1, wherein in the step of receiving the HTTP network packets and the SQL database packets in the time interval, respectively, The HTTP network packet listener and a SQL database packet listener receive the HTTP network packets and the database packets in the time interval. The HTTP network packet and the database packet auditing method of the dynamic web address described in claim 1 further includes a retention time according to the variable quantity accumulation table, and the number of the variable number accumulation table exceeding the retention time is cleared. A variable value. The HTTP network packet and the database packet auditing method of the dynamic URL according to claim 1, wherein the HTTP network packets are HTTP network packets of a dynamic URL. The HTTP network packet and database packet auditing method of the dynamic web address described in claim 1, wherein the step of calculating the number of the first variable values included in the HTTP network packets in the time interval is The plurality of variable values after the first symbol "/" after at least one global resource address information (URL) included in each of the HTTP network packets are regarded as the first variable values. A HTTP network packet and database packet auditing system for a dynamic web address, comprising: an HTTP network packet listener for capturing a plurality of HTTP network packets transmitted by a client to a network server, each The HTTP network packet includes at least one URL; an SQL database packet listener for capturing a plurality of SQL database packets transmitted by the network server to a data server, and each of the SQL databases The packet includes at least one SQL database statement; an associated auditing device is respectively connected to the HTTP network packet listener and the SQL database packet listener, and the HTTP network packet listener is in a time interval After the plurality of HTTP network packets are transmitted, the HTTP network packets are transmitted to the associated auditing device, and the SQL database packet listener transmits the SQL database packets after capturing the plurality of SQL database packets in the time interval. To the associated auditing device, the correlation auditing device includes: a variable statistic module, configured to accumulate the first variable values included in the HTTP network packets in the time interval to a change The quantity quantity accumulation table is used as a variable statistics hash table; an audit module uses and checks the second variable values included in the SQL database package, and the cull is different from the first variables in the variable statistics hash table And the second variable value of the value, and subtracting each of the second variable values that are the same as each of the first variable values in the variable statistics hash table by more than a predetermined threshold value, and then remaining The second variable value finds the HTTP network packets associated with the SQL database statements included in the SQL database package to establish the SQL database package and one of the HTTP network packets. Audit the association table. The HTTP network packet and the database packet auditing system of the dynamic URL according to claim 6, wherein the variable statistics module clears the retention time of the variable number accumulation table according to a retention time of the variable quantity accumulation table. The first variable values. The HTTP network packet and the database packet auditing system of the dynamic web address as claimed in claim 6, wherein the HTTP network packets are HTTP network packets of a dynamic web address.