Abstract: SQL injection attack is the main security threat faced by Web.Aiming at the problem that SQL injection is hard to detect,this paper proposed an SQL injection detection method based on N-Gram.The method transforms the SQL statements into the feature vectors with fixed dimension based on N-Gram,and the distance is improved by changing the weights of different feature subsequences.The fuzzy distance obtained from the improved distance and chi-square distance through BP neural network is used as the distance criterion between vectors.Firstly,the average feature vector of the secure SQL statements is calculated.Then,the distances between every SQL sentence and average feature vector are calculated to determine the distance threshold.The distance between the unknown SQL statement and the average feature vector is compared with the distance threshold to judge the safety of the unknown SQL statement.The experimental results show that the proposed method can effectively improve the true positive rate and reduce the false positive rate in terms of detection compared with the feature vector directly composed by words.

Key words: N-Gram, Feature vector, Neural network, SQL injection