Approach to detecting SQL injection behaviors in network environment

Yu-fei ZHAO; Gang XIONG; Long-tao HE; Zhou-jun LI

doi:10.11959/j.issn.1000-436x.2016034

您当前的位置：

首页 >

文章列表页 >

Approach to detecting SQL injection behaviors in network environment

academic paper | 更新时间：2024-06-05

- Approach to detecting SQL injection behaviors in network environment
- Journal on Communications Vol. 37, Issue 2, Pages: 89-98(2016)
- 作者机构：
  
  1. 北京航空航天大学计算机学院，北京 100083
  2. 中国科学院信息工程研究所，北京 100093
  3. 国家计算机网络应急技术处理协调中心，北京 100029
- 作者简介：
- 基金信息：
  
  The National High Technology Research and Development Program of China (863 Program)(2015AA016004);The National Natural Science Foundation of China(61170189);The National Natural Science Foundation of China(61370126);The National Natural Science Foundation of China(20111102130003);The National Science and Technology Support Program(2012BAH46B02);The Knowledge Innovation Pro-gram of the Chinese Academy of Sciences(XDA06030200)
- DOI：10.11959/j.issn.1000-436x.2016034
  CLC： TP393
- Online First：2016-02，
  
  Published：15 February 2016
- 稿件说明：
移动端阅览
Yu-fei ZHAO, Gang XIONG, Long-tao HE, et al. Approach to detecting SQL injection behaviors in network environment[J]. Journal on Communications, 2016, 37(2): 89-98.
DOI：

Yu-fei ZHAO, Gang XIONG, Long-tao HE, et al. Approach to detecting SQL injection behaviors in network environment[J]. Journal on Communications, 2016, 37(2): 89-98. DOI： 10.11959/j.issn.1000-436x.2016034.

摘要

SQL 注入攻击是 Web 应用面临的主要威胁之一，传统的检测方法针对客户端或服务器端进行。通过对SQL注入的一般过程及其流量特征分析，发现其在请求长度、连接数以及特征串等方面，与正常流量相比有较大区别

并据此提出了基于长度、连接频率和特征串的LFF（length-frequency-feature）检测方法，首次从网络流量分析的角度检测SQL注入行为。实验结果表明，在模拟环境下，LFF检测方法召回率在95%以上，在真实环境下，该方法也取得较好的检测效果。

Abstract

SQL injection attack is one of the main threats that many Web applications faced with. The traditional detection method depended on the clients or servers. Firstly the process of SQL injection attack was analyzed

and then the differences between attack traffic and normal traffic HTTP request length

HTTP connections and feature string were discovered. Based on the request length

request frequency and feature string

a new method

LFF (length-frequency-feature)

was proposed to detect SQL injection behaviors from network traffic. The results of experiments indicated that in simulation environments the recall of LFF approach reach up to 95%

and in real network traffic the LFF approach also get a good detection result.

关键词

Keywords

references

OWASP 2013 top 10 risks [EB/OL ] . https://www.owasp.org/index.php/Top_10_2013-Top_10 https://www.owasp.org/index.php/Top_10_2013-Top_10 , 2015 - 3 - 12 .

MCDONALD, S . SQL Injection: modes of attack, defense, and why it matters [EB/OL ] . http://www.governmentsecurity.org/articles/SQLInjectionModesofAttackDefenceandWhyItMatters.php http://www.governmentsecurity.org/articles/SQLInjectionModesofAttackDefenceandWhyItMatters.php , 2015 - 3 - 11 .

ORSO A , HALFOND W G J , VIEGAS J . A classification of SQL injection attacks and countermeasures [C ] // The International Symposium on Secure Software Engineering . c2006 .

APPELT D , NGUYEN D C , BRIAND L . Behind an application irewall, are we safe from SQL injection attacks [C ] // IEEE International Conference on Software Testing, Verification and Validation (ICST) . c2015 : 1 - 10 .

马小婷 , 胡国平 , 李舟军 . SQL注入漏洞检测与防御技术研究 [J ] . 计算机安全 , 2010 ( 11 ): 18 - 24 .

MA X T , HU G P , LI Z J . Research on detection and prevention technologies for SQL injection vulnerability [J ] . Computer Security , 2010 ( 11 ): 18 - 24 .

HALFOND W G J , ORSO A . AMNESIA: analysis and monitorin for NEutralizing SQL-injection attacks [C ] // 20th IEEE/ACM International Conference on Automated Software Engineering . ACM , c2005 : 174 - 183 .

HALFOND W G J , ORSO A . Detection and prevention of SQL injection attacks [J ] . Malware Detection , 2006 , ( 27 ): 85 - 109 .

SHAR L K , TAN H B K , BRIAND L C . Mining SQL injection cross site scripting vulnerabilities using hybrid program analysis [C ] // 2013 International Conference on Software Engineering . IEEE Press , c2013 : 642 - 651 .

SHAHRIAR H , NORTH S , CHEN W C . Early detection of SQL injection attacks [J ] . International Journal of Network Security ＆ Its Applications , 2013 , 5 ( 4 ): 53 - 65 .

VALEUR F , MUTZ D , VIGNA G . A learning-based approach to the detection of SQL attacks [M ] . Detection of Intrusions and Malware, and Vulnerability Assessment , Springer Berlin Heidelberg , 2005 : 123 - 140 .

KEMALIS K , TZOURAMANIS T . SQL-IDS: a specification-based approach for SQL-injection detections [C ] // 2008 ACM Symposium on Applied Computing . ACM , c2008 : 2153 - 2158 .

陆开奎 . 基于动态污点分析的漏洞攻击检测技术研究与实现 [D ] . 成都: 电子科技大学 , 2013 .

LU K K . The Research and realization of dynamic taint analysis based security attack detection technology [D ] . Chengdu: University of Electronic Science and Technology of China , 2013 .

HUANG Y W , HUANG S K , TSAI C H . Web application security assessment by fault injection and behavior monitoring [C ] // WWW’03 International Conference on World Wide Web . c2003 : 148 - 159 .

KALS S , KIRDA E , KRUEGEL C , et al . SecuBat: a Web vulnerability scanner [C ] // International Conference on World Wide Web . c2006 : 247 - 256 .

APPELT D , NGUYEN C D , BRIAND L C , et al . Automated testing for SQL injection vulnerabilities: an input mutation approach [C ] // In ternational Symposium on Software Testing ＆ Analysis . c2014 : 259 - 269 .

王苏南 . 高速复杂网络环境下异常流量检测技术研究 [D ] . 郑州:解放军信息工程大学 , 2012 .

WANG S N . Research on anomaly detection technology in high-speed complex network environment [D ] . Zhengzhou: PLA Information Engineering University , 2012 .

ZHANG J , XIANG Y , WANG Y , et al . Network traffic classification using correlation information [J ] . IEEE Transactions on Parallel ＆ Distributed Systems , 2013 , 24 ( 1 ): 104 - 117 .

周爱平 , 程光 , 郭晓军 . 高速网络流量测量方法 [J ] . 软件学报 , 2014 , 25 ( 1 ): 135 - 153 .

ZHOU A P , CHENG G , GUO X J . High-speed network traffic measurement method [J ] . Journal of Software , 2014 , 25 ( 1 ): 135 - 153 .

王鹏 , 兰巨龙 , 陈庶樵 . 粒度自适应的多径流量分割算法 [J ] . 通信学报 , 2015 , 36 ( 1 ): 211 - 217 .

WANG P , LAN J L , CHEN S Q . Multipath traffic splitting algorithm based on adaptive granularity [J ] . Journal on Communicatio , 2015 , 36 ( 1 ): 211 - 217 .

Pangolin-SQLinjection tools [EB/OL ] . http://nosec.org/cn/productservice/pangolin http://nosec.org/cn/productservice/pangolin , 2014 - 12 - 22 .

Sqlmap-Automatic SQL injection and databasetakeover tool [EB/OL ] . http://sqlmap.org/ http://sqlmap.org/ , 2015 - 3 - 5 .

Views

2251

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Network traffic cognition model based on space-time fractals

Research on traffic representation in network anomaly detection

Network intrusion detection method based on VAE-CWGAN and fusion of statistical importance of feature

Adaptive random early detection algorithm based on network traffic level grade prediction

Network traffic anomaly detection method based on multi-scale characteristic

Related Author

DONG Guoqing

DONG Yuning

ZHANG Hui

TANG Pingping

CHANG Heyu

ZHANG Bin

SUN Jianwen

Yu FU

Related Institution

Anhui Huadong Photoelectric Technology Research Institute Co., Ltd.

College of Telecommunications and Information Engineering, Nanjing University of Posts and Telecommunications

School of Physics and Electronic Information, Anhui Normal University

Cryptography Engineering Institute, Information Engineering University

School of Mathematics and Information Engineering, Xinyang Vocational and Technical College

AI问答

⁰