Method to Detect SQL Injection Attacks for Complex Network Environment

Abstract:

SQL injection has become a serious security risk among all the attacks against Web application. The SQL injection attack allows an attacker to access the underlying database unrestrictedly, and furthermore, retrieves the confidential information of the corporation and the network user. We found that most of the existing researches are able to detect most of the attacks, but they do not consider the complexity involved in using the defense system and the eventual cost of modification of the original program. For this reason, we conducts an in-depth research on SQL injection and defense: requires no modification of the web application code,and can be adapted to different usage scenarios,involving also different operating systems and server applications,and can be able to detect all the known injection points for the test application

• Periodical: Advanced Materials Research (Volume 651)
• Pages: 841-845
• DOI: https://doi.org/10.4028/www.scientific.net/AMR.651.841
• Online since: January 2013
• Authors: Wu Min Pan
• Keywords: Network Security, Sql Injection Attack, SQL Server, System Security

References

[1] A. Nguyen-Tuong, S. Guarnieri, D. Greene, and D. Evans, Automatically hardening web applications using precise tainting, in 20th IFIP International Information Security Conference Makuhari-Messe, Chiba, Japan, 2005, pp.296-307.

DOI: 10.21236/ada436667

[2] T. Pietraszek and C. V. Berghe, Defending against injection attacks through context-sensitive string evaluation, in Eighth International Symposium on Recent Advances in Intrusion Detection, 2005, pp.124-145.

DOI: 10.1007/11663812_7

[3] W. Halfond and A. Orso, AMNESIA: analysis and monitoring for NEutralizing SQL-injection attacks, in Proceedings of the 20th IEEE/ACM international Conference on Automated software engineering, 2005, pp.174-183.

DOI: 10.1145/1101908.1101935

[4] G. Buehrer, B. W. Weide, and P. A. G. Sivilotti, Using parse tree validation to prevent SQL injection attacks, in Proceedings of the 5th international workshop on Software engineering and middleware, 2005, pp.106-113.

DOI: 10.1145/1108473.1108496

[5] Z. Su and G. Wassermann, The essence of command injection attacks in web applications, in Symposium on Principles of Programming Languages, 2006, pp.372-382.

DOI: 10.1145/1111037.1111070

[6] F. Valeur, D. Mutz, and G. Vigna, A learning-based approach to the detection of sql attacks, (2003).

[7] Y. Kosuga, K. Kernel, M. Hanaoka, M. Hishiyama, and Y. Takahama, Sania: Syntactic and Semantic Analysis for Automated Testing against SQL Injection, in Computer Security Applications Conference, 2007, pp.107-117.

DOI: 10.1109/acsac.2007.20

[8] InterSect Alliance, Snare Epilog for Windows, http: /www. intersectalliance. com/projects/EpilogWindows.

[9] M. Owens, The definitive guide to SQLite: Apress, (2006).