Detecting SQL injection attacks using query result size
- Authors
- Jang, Young-Su; Choi, Jin-Young
- Issue Date
- 7월-2014
- Publisher
- ELSEVIER ADVANCED TECHNOLOGY
- Keywords
- Web applications; Sensitive operation; Input validation; Sanitization; SQL injection; Query result size
- Citation
- COMPUTERS & SECURITY, v.44, pp.104 - 118
- Indexed
- SCIE
SCOPUS
- Journal Title
- COMPUTERS & SECURITY
- Volume
- 44
- Start Page
- 104
- End Page
- 118
- URI
- https://scholar.korea.ac.kr/handle/2021.sw.korea/98031
- DOI
- 10.1016/j.cose.2014.04.007
- ISSN
- 0167-4048
- Abstract
- Web applications are becoming an essential part of our everyday lives, with many of our activities dependent on the functionality and security of these applications. Web applications are ubiquitous, perform mission critical tasks, and handle sensitive user data. As the scale of these applications grows, injection vulnerabilities, such as SQL injections, become major security challenges. Most of these vulnerabilities stem from a lack of input validation; that is, web applications use malicious input as part of a sensitive operation without properly checking or sanitizing the input values. SQL injection attacks target databases that are accessible through a web front-end; moreover, they take advantage of flaws in the input validation logic of web components. In this paper, we exhibit a novel scheme that automatically transforms web applications, rendering them safe against SQL injection attacks. Our technique dynamically analyzes the developer-intended query result size for any input, and detects attacks by comparing this against the result of the actual query. We implement this technique in a tool for protecting Java-based web applications. An experimental evaluation demonstrates that our technique is effective against SQL injection vulnerabilities. (C) 2014 Published by Elsevier Ltd.
- Files in This Item
- There are no files associated with this item.
- Appears in
Collections - School of Cyber Security > Department of Information Security > 1. Journal Articles
![qrcode](https://api.qrserver.com/v1/create-qr-code/?size=55x55&data=https://scholar.korea.ac.kr/handle/2021.sw.korea/98031)
Items in ScholarWorks are protected by copyright, with all rights reserved, unless otherwise indicated.