SQL injection detection and prevention system with raspberry Pi honeypot cluster for trapping attacker

Abstract

One of the most common security attack for web application is SQL injection. It is an attack to acquire access to application's database through injection of script or malicious query attributes. This attack can be executed in any page of web application which interacts with database. SQL injection could be more dangerous if the victim was an enterprise system such as online banking. Many methods have been researched and developed to prevent SQL injection attacks. One of them is the use of a honeypot. This paper proposed a method for increasing system's capability to detect and prevent SQL injection attacks based on removal of SQL query attribute values and honeypot for trapping attackers. A honeypot is placed as decoy system to hide actual web server from attacker.Malicious queries from attackers will be sent to honeypot while normal queries will be sent directly to the real web server. Honeypot is also used to provide activity logging of each attack which can be used for further analysis. We play with Raspberry Pi because it is cheap and effective to be used as a honeypot. Due to its limited computational ability, we make cluster to improve its power. Based on conducted experiments, we could achieve up to 64% accuracy of SQL injection attack. Moreover, with the redirection, our honeypot could get more attack data to be analyzed.

Image Processing on Raspberry Pi Cluster

“…Cluster in their work has virtualization possibilities in order to satisfy PaaS (Platform-as-a-Service) architecture demands, with the special attention on the portability and container interconnections. The authors of [14] A cluster of 10 Raspberry Pi Model B nodes was used in [15] as a honeypot cluster in researching possibilities for detection and prevention of the SQL injection intruders. In [16], the authors compared a cluster of 14 Raspberry Pi modules with Intel Core i5 and Core i7 CPU computers.…”

Vulnerability assessment and patching management

“…The wrong input entered by the user should display an error message rather than displaying all the extra information from the user. This not only helps to avoid any type of injection but also catches the erroneous input For example: SELECT fieldlist FROM table WHERE id = 23 OR 1=1; --This code always matches the simple database of any web server and lets attacker gain access to the sensitive data [7]. Many popular websites have been exploited using this code.…”

Camouflaged With Size: A Case Study of Espionage Using Acquirable Single-Board Computers

“…In [16], authors have discussed possible usage of this device to launch different types of penetration tests to assess the security of a network. [17] uses Raspberry Pi as a Honeypot to detect SQL injection attacks and [18] deployed a Honeypot to simulate vulnerabilities and attract attackers. Hu et al used this device as a distributed vulnerability assessment tool [19].…”