Detection and Prevention of SQL Injection Attacks at Runtime Using Decision Tree Classification

Document Type : Original Article

Authors

1 مدیر گروه تحصیلات تکمیلی/دانشگاه آزاد اسلامی واحد قم

2 Information Security, Taali University

Abstract

The use of web applications has become increasingly popular in our routine activities, such as reading the news, paying bills, and shopping on-line. As the availability of these services grows, we are witnessing an increase in the number and sophistication of attacks that target web applications. SQL injection attacks are a serious security threat to web applications in the cyberspace. SQL injection attacks allow attackers to gain unlimited access to a database that includes                 applications and potentially sensitive information. Although researchers and practitioners have proposed different methods to solve the SQL injection problem, current approaches either fail to solve the full scope of the problem or have limitations that prevent their use and adoption. This study is designed to provide a method for detecting and preventing SQL injection attacks at runtime, which can detect and continuously monitor the existing and new attacks. The proposed detection and          prevention method by runtime monitoring and implementation of the decision tree classification on the SQL injection database, blocks existing SQL injection attacks and also detects new attacks using the database supervisor. In the end, the proposed method is compared with other methods for detecting and preventing existing SQL injection attacks, the results showing that the proposed method is significantly successful in detecting and preventing SQL injection attacks. Compared to the two methods explored in this article, the presented method increases the accuracy by 12% for one method and 16% for the other.
 

Keywords

References

   [1]      W. G. Halfond and A. Orso, “AMNESIA: analysis and monitoring for NEutralizing SQL-injection attacks,” in Proceedings of the 20th IEEE/ACM international Conference on Automated software engineering, 2005, pp. 174-183.##
   [2]      S. Kumar, R. Mahajan, N. Kumar, and S. K. Khatri, “A study on web application security and detecting security vulnerabilities,” in 2017 6th International Conference on Reliability, Infocom Technologies and Optimization (Trends and Future Directions)(ICRITO), 2017, pp. 451-455.##
   [3]      OWASP Top 10 Application Security Risks – 2017. Available: https://www.owasp.org/index.php/Top_10_2017-Top_10##
   [4]      W. G. Halfond and A. Orso, “Preventing SQL injection attacks using AMNESIA,” in Proceedings of the 28th international conference on Software engineering, pp. 795-798, 2006.##
   [5]      K. Beaver, Hacking for dummies: John Wiley & Sons, 2007.##
   [6]      M. T. Simpson, K. Backman, and J. Corley,    Hands-on ethical hacking and network defense: Cengage Learning, 2010.##
   [7]      W. G. Halfond, J. Viegas, and A. Orso, “A classification of SQL-injection attacks and countermeasures,” in Proceedings of the IEEE International Symposium on Secure Software Engineering, pp. 13-15, 2006.##
   [8]      E. R. Indrani Balasundaram, “An approach to detect and prevent SQL injection attacks in database using web service,” IJCSNS International Journal of Computer Science and Network Security, vol. 11, pp. 95-100, 2011.##
   [9]      R. Yeole, S. Ninawe, P. Dhore, and P. Tembhare, “A Study on Detection and Prevention of SQL Injection Attack,” 2017.##
[10]      U. Agarwal, M. Saxena, and K. S. Rana, “A Survey of SQL Injection Attacks,” International Journal of Advanced Research in Computer Science and Software Engineering, vol. 5, pp. 286-289, 2015.##
[11]      A. Tajpour, M. Z. Heydari, M. Masrom, and S. Ibrahim, “SQL injection detection and prevention tools assessment,” in Computer Science and Information Technology (ICCSIT), 2010 3rd IEEE International Conference on, pp. 518-522, 2010.##
[12]      C. Gould, Z. Su and P. Devanbu, “JDBC checker: A static analysis tool for SQL/JDBC applications,” in Proceedings of the 26th International Conference on Software Engineering, pp. 697-698, 2004.##
[13]      S. Madan and S. Madan, “Shielding against sql injection attacks using admire model,” in Computational Intelligence, Communication Systems and Networks, 2009. CICSYN'09. First International Conference on, pp. 314-320, 2009,##
[14]      B. Indrani and E. Ramaraj, “X–LOG Authentication Techniqe to Prevent SQL Injection Attacks,” International Journal of Information Technology and Knowledge Management, vol. 4, pp. 323-328, 2011.##
[15]      G. Buehrer, B. W. Weide, and P. A. Sivilotti, “Using parse tree validation to prevent SQL injection attacks,” in Proceedings of the 5th international workshop on Software engineering and middleware, pp. 106-113, 2005.##
[16]      Z. Su and G. Wassermann, “The essence of command injection attacks in web applications,” in ACM SIGPLAN Notices, pp. 372-382, 2006.##
[17]      A. Sadeghian, M. Zamani, and A. A. Manaf, “SQL injection vulnerability general patch using header sanitization,” in Computer, Communications and Control Technology (I4CT), 2014 International Conference on, pp. 239-242, 2014.##
[18]      A. Pramod, A. Ghosh, A. Mohan, M. Shrivastava, and R. Shettar, “SQLI detection system for a safer web application,” in Advance Computing Conference (IACC), 2015 IEEE International, pp. 237-240, 2015.##
[19]      A. Makiou, Y. Begriche, and A. Serhrouchni, “Improving Web Application Firewalls to detect advanced SQL injection attacks,” in Information Assurance and Security (IAS), 2014 10th International Conference on, pp. 35-40, 2014.##
[20]      Y.-W. Huang, F. Yu, C. Hang, C.-H. Tsai, D.-T. Lee, and S.-Y. Kuo, “Securing web application code by static analysis and runtime protection,” in Proceedings of the 13th international conference on World Wide Web, pp. 40-52, 2004.##
[21]      A. S. Christensen, A. Møller, and M. I. Schwartzbach, “Precise analysis of string expressions,” in International Static Analysis Symposium, pp. 1-18, 2003.##
[22]      D. Sharma, K. Kale, C. Date, and D. Bhave, “Using AMNESIA to secure web applications and database against SQL injection attack,” 2017.##
[23]      K. Kemalis and T. Tzouramanis, “SQL-IDS: a specification-based approach for SQL-injection detection,” in Proceedings of the 2008 ACM symposium on Applied computing, pp. 2153-2158, 2008.##
[24]      V. Kodaganallur, “Incorporating language processing into java applications: A javacc tutorial,” IEEE software, vol. 21, pp. 70-77, 2004.##
[25]      M. S. Lam, M. Martin, B. Livshits, and J. Whaley, “Securing web applications with static and dynamic information flow tracking,” in Proceedings of the 2008 ACM SIGPLAN symposium on Partial evaluation and semantics-based program manipulation, pp. 3-12, 2008.##
[26]      V. B. Livshits and M. S. Lam, “Finding Security Vulnerabilities in Java Applications with Static Analysis,” in USENIX Security Symposium, pp.   18-18, 2005.##
[27]      Y. V. N. Manikanta and A. Sardana, “Protecting web applications from SQL injection attacks by using framework and database firewall,” in Proceedings of the International Conference on Advances in Computing, Communications and Informatics, pp. 609-613, 2012.##
[28]      I. Lee, S. Jeong, S. Yeo, and J. Moon, “A novel method for SQL injection attack detection based on removing SQL query attribute values,” Mathematical and Computer Modelling, vol. 55, pp. 58-68 ,2012.##
[29]      B. Tajalipour and A. Safaie, “Structural  and semantic  analysis of query  to detect  SQL injection attacks,” Journal of Electronical & Cyber Defence, vol. 2, pp. 83-97, 2014. (In Persian)##
[30]      M. Alkhalaf, A. Aydin, and T. Bultan, “Semantic differential repair for input validation and sanitization,” in Proceedings of the 2014 International Symposium on Software Testing and Analysis, pp. 225-236, 2014.##
[31]      K. Frajták, M. Bureš, and I. Jelínek, “Reducing user input validation code in web applications using Pex extension,” in Proceedings of the 15th International Conference on Computer Systems and Technologies, pp. 302-308, 2014.##
[32]      X. Li and Y. Xue, “A survey on server-side approaches to securing web applications,” ACM Computing Surveys (CSUR), vol .46, p. 54, 2014.##
[33]      S. Cho, G. Kim, S.-j. Cho, J. Choi, M. Park, and S. Han, “Runtime input validation for Java web applications using static bytecode instrumentation,” in Proceedings of the International Conference on Research in Adaptive and Convergent Systems, pp. 148-152, 2016.##
[34]      I. Medeiros, N. F. Neves, and M. Correia, “Automatic detection and correction of web application vulnerabilities using data mining to predict false positives,” in Proceedings of the 23rd internati

Files

History

  • Receive Date: 26 April 2021
  • Accept Date: 26 April 2021
  • Publish Date: 26 April 2021

Share

How to cite

Statistics