Detection and Prevention of SQL Injection Attack by Dynamic Analyzer and Testing Model

Abstract

Abstract-With the emergence and popularity of web application, threats related to web applications has increased to large extent. Among many other web applications threats Structured Query Language Injection Attack (SQLIA) is the dominant in its use due to its ability to access the data. Many solutions are proposed in this regard that has success in specific conditions. The proposed model is based on the dynamic analyzer model. The proposed model also has certain advantages like wide applicability, fast response time, coverage to large number of techniques of SQL Injections (SQLI) and efficient in term of resource usage.

A Critical Evaluation of Security Approaches for Detection and Prevention of SQL Injection Attacks in Web-Based Applications

“…JavaScript. Rana, et al (2017) proposed a method based on the hierarchical analyzer model. The framework receives a request from the client and assesses it with the help of a knowledge base, thereby categorizing the request as one that is for pages with no loopholes (P') and that for pages with weaknesses (P).…”

A detection methodology for SQL injection attacks based on the TF-IDF-CHI algorithm

“…Research methods for detecting SQL injection attacks can be categorized into traditional SQL injection detection methods and machine learning-based SQL injection detection methods [3]. Traditional SQL injection detection methods include static analysis and dynamic analysis [4,5]. However, both static and dynamic analyses are plagued by issues of low detection accuracy and high manual effort.…”

Deep learning approaches to SQL injection detection: evaluating ANNs, CNNs, and RNNs

“…However, as web technologies and defense mechanisms became more advanced, the complexity of SQLi attacks has also progressed. Modern SQLi techniques can bypass many traditional security measures, making them particularly challenging to address 6 . Given the significance of databases in the storage of many types of data, ranging from personal user information to corporate financial records, the interests involved in defending against SQL attacks are incredibly high.…”