nach oben

Erschienen in:

2024 | OriginalPaper | Buchkapitel

SQL Injection Attack Detection and Prevention Based on Manipulating the SQL Query Input Attributes

verfasst von : R. Mahesh, Samuel Chellathurai, Meyyappan Thirunavukkarasu, Pandiselvam Raman

Erschienen in: Computational Sciences and Sustainable Technologies

Verlag: Springer Nature Switzerland

Einloggen

Aktivieren Sie unsere intelligente Suche, um passende Fachinhalte oder Patente zu finden.

search-config

KI-gestützte Suche

Aus

Abstract

SQL injection refers to one of the types of database attacks for web applications. The database security is compromised when wild card characters, malicious code, or malicious SQL query string are injected into the database. These changes in syntax and semantic allow the attacker to gain access to sensitive information and manipulate the database. Various techniques have been developed to detect and prevent this type of attacks. In this article, we proposed an method for preventing and detecting SQL injection. This method manipulates the SQL query input parameters and determining the distance between query strings. This method satisfies static query and dynamic also.

Sie haben noch keine Lizenz? Dann Informieren Sie sich jetzt über unsere Produkte:

Springer Professional "Wirtschaft+Technik"

Online-Abonnement

Mit Springer Professional "Wirtschaft+Technik" erhalten Sie Zugriff auf:

über 102.000 Bücher
über 537 Zeitschriften

aus folgenden Fachgebieten:

Automobil + Motoren
Bauwesen + Immobilien
Business IT + Informatik
Elektrotechnik + Elektronik
Energie + Nachhaltigkeit
Finance + Banking
Management + Führung
Marketing + Vertrieb
Maschinenbau + Werkstoffe
Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

Jetzt informieren

Springer Professional "Technik"

Online-Abonnement

Mit Springer Professional "Technik" erhalten Sie Zugriff auf:

über 67.000 Bücher
über 390 Zeitschriften

aus folgenden Fachgebieten:

Automobil + Motoren
Bauwesen + Immobilien
Business IT + Informatik
Elektrotechnik + Elektronik
Energie + Nachhaltigkeit
Maschinenbau + Werkstoffe

Jetzt Wissensvorsprung sichern!

Jetzt informieren

Springer Professional "Wirtschaft"

Online-Abonnement

Mit Springer Professional "Wirtschaft" erhalten Sie Zugriff auf:

über 67.000 Bücher
über 340 Zeitschriften

aus folgenden Fachgebieten:

Bauwesen + Immobilien
Business IT + Informatik
Finance + Banking
Management + Führung
Marketing + Vertrieb
Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

Jetzt informieren

Vorheriges Kapitel Video Summarization on E-Sport

Nächstes Kapitel Comparative Analysis of State-of-the-Art Face Recognition Models: FaceNet, ArcFace, and OpenFace Using Image Classification Metrics

Anley, C.: Advanced SQL Injection In SQL Server Applications. Next Generation Security Software Ltd, White Paper (2002)

Boyd, S.W., Keromytis, A.D.: SQLrand: preventing SQL injection attacks. In: Jakobsson, M., Yung, M., Zhou, J. (eds.) ACNS 2004. LNCS, vol. 3089, pp. 292–302. Springer, Heidelberg (2004). https://doi.org/10.1007/978-3-540-24852-1_21CrossRef

Gould, C., Su, Z., Devanbu, P.: JDBC checker: a static analysis tool for SQL/JDBC applications. In: Proceedings of the 26th International Conference on Software Engineering (ICSE), pp. 697–698 (2004)

Huang, Y.-W., Yu, F., Hang, C., Tsai, C.-H., Lee, D.T., Kuo, S.-Y.: Securing Web application code by static analysis and runtime protection. In: Proceedings of the 12th International World Wide Web Conference (WWW 2004), pp. 40–52 (2004)

Halfond, W.G., Orso, A.: AMNESIA: analysis and monitoring for NEutralizing SQL-injection attacks. In: ACM, ASE 2005, November 7–11 (2005)

Buehrer, G., Weide, B.W., Sivilotti, P.A.G.: Using parse tree validation to prevent SQL injection attacks. In: Proceeding of the 5th International Workshop on Software Engineering and Middleware, pp. 106–113 ACM (2005)

McClure, R., Krger, I.: SQL DOM: compile time checking of dynamic SQL statements. In: Proceedings of the 27th International Conference on Software Engineering (ICSE 2005), pp. 88–96 (2005)

Buehrer, G., Weide, B.W., Sivilotti, P.A.: Using parse tree validation to prevent SQL InjectionAttacks, SEM 2005. In: Proceedings of the 5th international workshop on Software engineering and middleware, pp. 106–113 (2005)

Halfond, W.G., Orso, A., Manolios, P.: Using positive tainting and syntax-aware evaluation to counter sql injection attacks. In: ACM-SIGSOFT, pp. 175–185 (2006)

10.

Su, Z., Wassermann, G.: The essence of command injection attacks in web applications. In: Conference Record of the 33rd ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, pp. 372–382 (2006)

11.

Rietta, F.S.: Application layer intrusion detection for SQL injection, ACM-SE 44. In: Proceedings of the 44th annual Southeast regional conference, pp. 531–536 (2006)

12.

Wei, K., Muthuprasanna, M., Kothari, S.: Preventing SQL injection attacks in stored procedurce. In: Software Engineering Conference, pp. 18–21 (2006)

13.

Kosuga, Y., Kono, K., Hanaoka, M., Hishiyama, M., Takahama, Y.: Syntactic and semantic analysis for automated testing against SQL injection. In: Proceedings of the Computer Security Application Conference, pp. 107–117 (2007)

14.

Bandhakavi, S., Bisht, P., Madhusudan, P., Venkatakrishnan, V.N.: CANDID: preventing SQL injection attacks using dynamic candidate evaluations. In: Proceedings of the Computer Security Application Conference, pp. 12–24 (2007)

15.

Rawat, R., Dangi, C.S., Patil, J.: Safe guards anomalies against SQL injection attacks. Int. J. Comput. Appl. 22(2), 11–14 (2011)

16.

Das, D., Sharma, U., Bhattacharyya, D.K.: An approach to detection of SQL injection attack based on dynamic query matching. Int. J. Comput. Appl. 127(14), 15–24 (2010)

17.

Ciampa, A., Visaggio, C.A., Di Penta, M.: A heuristic-based approach for detecting SQL-injection vulnerabilities in Web applications. In: SESS 2010: Proceedings of the 2010 ICSE Workshop on Software Engineering for Secure Systems, pp. 43–49 (2010)

18.

Lee, I., Jeong, S., Yeo, S., Moon, J.: Novel method for SQL injection attack detection based on removing SQL query attribute values. Math. Comput. Model. 55(1–2), 58–68 (2012)MathSciNetCrossRef

19.

Kar, D., Panigrahi, S., Sundararajan, S.: SQLiGoT: detecting SQL injection attacks using graph of tokens and SVM. Comput. Secur. 60, 206–225 (2016)CrossRef

20.

Li, Q., Wang, F., Wang, J., Li, W.: LSTM-based SQL injection detection method for intelligent transportation system. IEEE Trans. Veh. Technol. 68(5), 4182–4191 (2019)

21.

Gu, H., et al.: DIAVA: a traffic-based framework for detection of SQL injection attacks and vulnerability analysis of leaked data. IEEE Trans. Reliab. 69(1), 188–202 (2020)CrossRef

22.

Liu, M., Li, K., Chen, T.: DeepSQLi: deep semantic learning for testing SQL injection, ISSTA 2020. In: Proceedings of the 29th ACM SIGSOFT, pp. 286–297 (2020)

Titel: SQL Injection Attack Detection and Prevention Based on Manipulating the SQL Query Input Attributes
verfasst von: R. Mahesh
Samuel Chellathurai
Meyyappan Thirunavukkarasu
Pandiselvam Raman
Verlag: Springer Nature Switzerland
Buch: Computational Sciences and Sustainable Technologies
Print ISBN: 978-3-031-50992-6

Electronic ISBN: 978-3-031-50993-3

Copyright-Jahr: 2024
DOI: https://doi.org/10.1007/978-3-031-50993-3_17

Springer Professional

Abstract

Bitte loggen Sie sich ein, um Zugang zu Ihrer Lizenz zu erhalten.

Sie haben noch keine Lizenz? Dann Informieren Sie sich jetzt über unsere Produkte:

Springer Professional "Wirtschaft+Technik"

Springer Professional "Technik"

Springer Professional "Wirtschaft"

Premium Partner