Collaborative SQL-injections detection system with machine learning

Abstract

Data mining and information extraction from data is a field that has gained relevance in recent years thanks to techniques based on artificial intelligence and use of machine and deep learning. The main aim of the present work is the development of a tool based on a previous behaviour study of security audit tools (oriented to SQL pentesting) with the purpose of creating testing sets capable of performing an accurate detection of a SQL attack. The study is based on the information collected through the generated web server logs in a pentesting laboratory environment. Then, making use of the common extracted patterns from the logs, each attack vector has been classified in risk levels (dangerous attack, normal attack, nonattack, etc.). Finally, a training with the generated data was performed in order to obtain a classifier system that has a variable performance between 97 and 99 percent in positive attack detection. The training data is shared to other servers in order to create a distributed network capable of deciding if a query is an attack or is a real petition and inform to connected clients in order to block the petitions from the attacker's IP.

SQL Injection Detection for Web Applications Based on Elastic-Pooling CNN

“…For comparison, traditional machine learning methods are used to classify and compare the accuracy and F1 values, including SVM [2], [3], Naive Bayes [4], [6], Decision Tree [4], [5], and Random Forest [23], all of the training sets for these traditional machine learning methods is randomly selected from the training sets of EP-CNN. After many tests, we use 10000 query strings to train SVM and Naive Bayes model, and 100000 query strings to train Random Forest and Decision Tree model.…”

“…But the training time and testing time is higher than others too, that is because EP-CNN and CNN have more computational load in the testing process. In the traditional machine learning methods of SVM [2], [3], Naive Bayes [4], [6], Decision Tree [4], [5], and Random Forest [23], the effect of Naive Bayes [6], [4], is much worse than that of the other methods because it is based on the conditional independence hypothesis; that is, the position correlation information between characters is split. However, SQL injection is closely related to location correlation between characters.…”

“…2. According to a certain way of query sentence segmentation, statistics of the frequency of each word [4] is also a way of data preprocessing. This method splits the relationship between words, resulting in a large scale of loss of sentence information, affecting the subsequent classification effect.…”

“…After vectorizing the extracted features, the traditional machine learning method is used for classification and recognition. Naive Bayes [4], [6], Decision Tree [4], [5], and Support Vector Machine (SVM) [2], [3] are commonly used. There are many detection methods that do not use machine learning and that include classification technology based on user behavior [12], [13] and expectation criteria [14].…”

“…Existing methods for identifying SQL injection attacks include regular matching [1], Support Vector Machine (SVM) technology [2], [3], Decision Tree [4], [5], Naive Bayes [4], [6], etc. Among them, regular matching is widely…”