【摘要】 为对电力Web信息系统进行更为有效的SQL注入漏洞检测,提出一种基于特征的SQL注入漏洞自动化渗透测试方法。针对电力信息系统的安全特征,建立其渗透测试的特征矩阵FM (feature matrix)模型,基于启发式的特征筛选HFS (heuristic feature selection)算法构建精简的有效测试集合。实现一个原型系统,在模拟电力信息系统环境搭建的目标数据集上进行实验对比分析,结果表明,该方法能有效提高SQL注入漏洞检测的准确度和检测效率。更多还原

【Abstract】 To carry out more effective detection of SQL injection vulnerability in power information system,a feature based automatic penetration test approach for SQL injection vulnerability was proposed.According to the security characteristics of power information system,the feature matrix(FM)model of penetration test was established,and a streamlined valid test set was constructed based on a heuristic feature selection(HFS)algorithm.A prototype system was implemented,and the experimental comparison and analysis were carried out on the target data set built in the simulated power information system environment.The results show that the proposed method can effectively improve the test accuracy and efficiency of SQL injection vulnerability detection.更多还原