Data-mining based SQL injection attack detection using internal query trees
DC Field | Value | Language |
---|---|---|
dc.contributor.author | Kim, Mi-Yeon | - |
dc.contributor.author | Lee, Dong Hoon | - |
dc.date.accessioned | 2021-09-05T05:30:23Z | - |
dc.date.available | 2021-09-05T05:30:23Z | - |
dc.date.created | 2021-06-15 | - |
dc.date.issued | 2014-09-01 | - |
dc.identifier.issn | 0957-4174 | - |
dc.identifier.uri | https://scholar.korea.ac.kr/handle/2021.sw.korea/97445 | - |
dc.description.abstract | Detecting SQL injection attacks (SQLIAs) is becoming increasingly important in database-driven web sites. Until now, most of the studies on SQLIA detection have focused on the structured query language (SQL) structure at the application level. Unfortunately, this approach inevitably fails to detect those attacks that use already stored procedure and data within the database system. In this paper, we propose a framework to detect SQLIAs at database level by using SVM classification and various kernel functions. The key issue of SQLIA detection framework is how to represent the internal query tree collected from database log suitable for SVM classification algorithm in order to acquire good performance in detecting SQLIAs. To solve the issue, we first propose a novel method to convert the query tree into an n-dimensional feature vector by using a multi-dimensional sequence as an intermediate representation. The reason that it is difficult to directly convert the query tree into an n-dimensional feature vector is the complexity and variability of the query tree structure. Second, we propose a method to extract the syntactic features, as well as the semantic features when generating feature vector. Third, we propose a method to transform string feature values into numeric feature values, combining multiple statistical models. The combined model maps one string value to one numeric value by containing the multiple characteristic of each string value. In order to demonstrate the feasibility of our proposals in practical environments, we implement the SQUA detection system based on PostgreSQL, a popular open source database system, and we perform experiments. The experimental results using the internal query trees of PostgreSQL validate that our proposal is effective in detecting SQLIAs, with at least 99.6% of the probability that the probability for malicious queries to be correctly predicted as SQLIA is greater than the probability for normal queries to be incorrectly predicted as SQUA. Finally, we perform additional experiments to compare our proposal with syntax-focused feature extraction and single statistical model based on feature transformation. The experimental results show that our proposal significantly increases the probability of correctly detecting SQLIAs for various SQL statements, when compared to the previous methods. (C) 2014 Elsevier Ltd. All rights reserved. | - |
dc.language | English | - |
dc.language.iso | en | - |
dc.publisher | PERGAMON-ELSEVIER SCIENCE LTD | - |
dc.title | Data-mining based SQL injection attack detection using internal query trees | - |
dc.type | Article | - |
dc.contributor.affiliatedAuthor | Lee, Dong Hoon | - |
dc.identifier.doi | 10.1016/j.eswa.2014.02.041 | - |
dc.identifier.scopusid | 2-s2.0-84898424321 | - |
dc.identifier.wosid | 000336191800035 | - |
dc.identifier.bibliographicCitation | EXPERT SYSTEMS WITH APPLICATIONS, v.41, no.11, pp.5416 - 5430 | - |
dc.relation.isPartOf | EXPERT SYSTEMS WITH APPLICATIONS | - |
dc.citation.title | EXPERT SYSTEMS WITH APPLICATIONS | - |
dc.citation.volume | 41 | - |
dc.citation.number | 11 | - |
dc.citation.startPage | 5416 | - |
dc.citation.endPage | 5430 | - |
dc.type.rims | ART | - |
dc.type.docType | Article | - |
dc.description.journalClass | 1 | - |
dc.description.journalRegisteredClass | scie | - |
dc.description.journalRegisteredClass | scopus | - |
dc.relation.journalResearchArea | Computer Science | - |
dc.relation.journalResearchArea | Engineering | - |
dc.relation.journalResearchArea | Operations Research & Management Science | - |
dc.relation.journalWebOfScienceCategory | Computer Science, Artificial Intelligence | - |
dc.relation.journalWebOfScienceCategory | Engineering, Electrical & Electronic | - |
dc.relation.journalWebOfScienceCategory | Operations Research & Management Science | - |
dc.subject.keywordAuthor | Intrusion detection | - |
dc.subject.keywordAuthor | SQL injection attack | - |
dc.subject.keywordAuthor | Database | - |
dc.subject.keywordAuthor | Data mining | - |
dc.subject.keywordAuthor | SVM | - |
Items in ScholarWorks are protected by copyright, with all rights reserved, unless otherwise indicated.
(02841) 서울특별시 성북구 안암로 14502-3290-1114
COPYRIGHT © 2021 Korea University. All Rights Reserved.
Certain data included herein are derived from the © Web of Science of Clarivate Analytics. All rights reserved.
You may not copy or re-distribute this material in whole or in part without the prior written consent of Clarivate Analytics.