SQL injection interception detection method and device, apparatus and computer readable medium

A device for detecting a Structured Query Language (SQL) injection interception, comprising:

• a detection module, implemented in one or more processors executing instructions stored in one or more computer-readable memory, configured for detecting a received SQL instruction according to a SQL syntax tree rule to determine that the received SQL instruction is a malicious instruction;
• and
• an analysis module, implemented in the one or more processors executing instructions stored in the one or more computer-readable memory,
• configured for analyzing the received SQL instruction by using an analysis model to determine that the received SQL instruction is a potentially malicious instruction, in a case that the received SQL instruction is not determined to be a malicious instruction according to the SQL syntax tree rule,
• wherein the analysis module includes:
• a vector generation submodule, implemented in the one or more processors executing instructions stored in the one or more computer-readable memory, configured for generating a vector of the received SQL instruction according to a grammar rule;
• and
• a similarity calculation submodule, implemented in the one or more processors executing instructions stored in the one or more computer-readable memory, configured for calculating a similarity between the vector of the received SQL instruction and a vector sample of a malicious SQL instruction, and for determining the received SQL instruction, the vector of which has a similarity larger than a preset threshold, to be a malicious instruction.