Evaluation of Anomaly Based Character Distribution Models in the Detection of SQL Injection Attacks

Abstract

The ubiquity of web applications has led to an increased focus on the development of attacks targeting these applications. One particular type of attack that has recently become prominent is the SQL injection attack. SQL injection attacks can potentially result in unauthorized access to confidential information stored in a backend database. In this paper we describe an anomaly based approach which utilizes the character distribution of certain sections of HTTP requests to detect previously unseen SQL injection attacks. Our approach requires no user interaction, and no modification of, or access to, either the backend database or the source code of the web application itself. Our practical results suggest that the model proposed in this paper is superior to existing models at detecting SQL injection attacks. We also evaluate the effectiveness of our model at detecting different types of SQL injection attacks.

AIIDA-SQL: An Adaptive Intelligent Intrusion Detector Agent for detecting SQL Injection attacks

“…Through the syntactic analysis of SQL query strings, the data of the HTTP requests are extracted to later be used in the training phase and to determine the threshold to use in the evaluation phase. Bertino, Kamra and Early [5] propose an anomaly detection mechanism applying data mining techniques. The main problem of this approach is to find an adequate threshold to maintain a low rate of both false positives and false negatives.…”

“…In [5] two types of SQL injection attacks are raised: tautology attacks and those based on the UNION operator. Through the syntactic analysis of SQL query strings, the data of the HTTP requests are extracted to later be used in the training phase and to determine the threshold to use in the evaluation phase.…”

“…Different strategies have been presented as a solution to the problem of SQL injection attacks [1], with special attention given to strategies based on IDSs [2], [3], [4], [5], [6], [7], [8], [9]. One approach based on anomaly detection was proposed by [2], applying a clustering strategy to group similar queries and isolate queries which are considered malicious.…”

“…This attack can be used to gain confidential information, to bypass authentication mechanisms, to modify the database, and to execute arbitrary code [2]. A large number of solutions has been proposed so far [3], [4], [5], [6], [7], [8], [9], but they can not defend against sophisticated attack techniques such as those that use alternate encodings and database commands to dynamically construct SQL strings. These approaches lack the learning and adaptation capabilities for dealing with attacks and their possible variations in the future.…”

Preventing SQL-BasedAttacks Using Intrusion Detection System

“…Kiani et al [12], used an anomaly detection approach. They called the model as same character comparison (SCC) model where HTTP request"s section were divided on the basis of character.…”