SDSIOT: An SQL Injection Attack Detection and Stage Identification Method Based on Outbound Traffic

Abstract

An SQL Injection Attack (SQLIA) is a major cyber security threat to Web services, and its different stages can cause different levels of damage to an information system. Attackers can construct complex and diverse SQLIA statements, which often cause most existing inbound-based detection methods to have a high false-negative rate when facing deformed or unknown SQLIA statements. Although some existing works have analyzed different features for the stages of SQLIA from the perspectives of attackers, they primarily focus on stage analysis rather than different stages’ identification. To detect SQLIA and identify its stages, we analyze the outbound traffic from the Web server and find that it can differentiate between SQLIA traffic and normal traffic, and the outbound traffic generated during the two stages of SQLIA exhibits distinct characteristics. By employing 13 features extracted from outbound traffic, we propose an SQLIA detection and stage identification method based on outbound traffic (SDSIOT), which is a two-phase method that detects SQLIAs in Phase I and identifies their stages in Phase II. Importantly, it does not need to analyze the complex and diverse malicious statements made by attackers. The experimental results show that SDSIOT achieves an accuracy of 98.57% for SQLIA detection and 94.01% for SQLIA stage identification. Notably, the accuracy of SDSIOT’s SQLIA detection is 8.22 percentage points higher than that of ModSecurity.

Analysis of SQL injection attacks in the cloud and in WEB applications

“…Lu et al 12 Alotaibi et al 13 Patidar et al 14 Liu et al 15 Alghawazi et al 16 Saini et al 17 Sheth et al 18 Okesola et al 19 Labib et al 20 Marashdih et al 21 Mehta et al 22 Henry et al 23 Pruzinec et al 24 Irungu et al 25 Fratty et al 26 Logozzo et al 27 Singh et al 28 Crespo-Martínez et al 29 Fu et al 30 Philip et al 31 Barsellotti et al 32 Mallissery et al 33 Lu et al 12 Alotaibi et al 13 Guan et al 34 Nasrullayev et al 35 Muhammad et al 36 Brintha et al 37 Al Badri et al [36] Lu et al 12 (2023)…”

Detecting Structured Query Language Injections in Web Microservices Using Machine Learning

“…Table 2 provides further details on the criteria implemented by various authors. [17] 0.9904 0.9898 0.9903 0.991 Artificial Neural Network (ANN) [13,18] 0.9893 0.9870 0.9913 0.99 AdaBoost (AB) [17,21] 0.9808 0.9559 0.9592 0.9561 Decision Tree (DT) [16,18,22,23] 0.9668 0.9315 0.88955 0.9164 Random Forest (RF) [18,22,23] 0.9634 0.9247 0.8947 0.9149 Support Vector Machine (SVM) [18,22,23] 0.9546 0.9706 0.9085 0.9395 Logistic Regression (LR) [4] 0.9503 0.9737 0.9089 0.9653 Naive Bayes (NB) [18,24] 0.9074 0.8966 0.7985 0.9010 KNN (K-Nearest Neighbors) [21] 0.8920 0.9143 0.8931 0.8853 Furthermore, the choice of these algorithms is justified for the following reasons. The decision tree (DT) algorithm is simple to interpret and allows for the identification of characteristics relevant to the detection of SQL injections.…”