SDSIOT: An SQL Injection Attack Detection and Stage Identification Method Based on Outbound Traffic
-
Published:2023-05-30
Issue:11
Volume:12
Page:2472
-
ISSN:2079-9292
-
Container-title:Electronics
-
language:en
-
Short-container-title:Electronics
Author:
Fu Houlong1ORCID,
Guo Chun1,
Jiang Chaohui1,
Ping Yuan2ORCID,
Lv Xiaodan1ORCID
Affiliation:
1. State Key Laboratory of Public Big Data, College of Computer Science and Technology, Guizhou University, Guiyang 550025, China
2. School of Information Engineering, Xuchang University, Xuchang 461000, China
Abstract
An SQL Injection Attack (SQLIA) is a major cyber security threat to Web services, and its different stages can cause different levels of damage to an information system. Attackers can construct complex and diverse SQLIA statements, which often cause most existing inbound-based detection methods to have a high false-negative rate when facing deformed or unknown SQLIA statements. Although some existing works have analyzed different features for the stages of SQLIA from the perspectives of attackers, they primarily focus on stage analysis rather than different stages’ identification. To detect SQLIA and identify its stages, we analyze the outbound traffic from the Web server and find that it can differentiate between SQLIA traffic and normal traffic, and the outbound traffic generated during the two stages of SQLIA exhibits distinct characteristics. By employing 13 features extracted from outbound traffic, we propose an SQLIA detection and stage identification method based on outbound traffic (SDSIOT), which is a two-phase method that detects SQLIAs in Phase I and identifies their stages in Phase II. Importantly, it does not need to analyze the complex and diverse malicious statements made by attackers. The experimental results show that SDSIOT achieves an accuracy of 98.57% for SQLIA detection and 94.01% for SQLIA stage identification. Notably, the accuracy of SDSIOT’s SQLIA detection is 8.22 percentage points higher than that of ModSecurity.
Funder
Science and Technology Support Program of Guizhou Province
Science and Technology Foundation of Guizhou Province
Key Technologies R&D Program of He’nan Province
Foundation of He’nan Educational Committee
Subject
Electrical and Electronic Engineering,Computer Networks and Communications,Hardware and Architecture,Signal Processing,Control and Systems Engineering
Reference41 articles.
1. Performance evaluation of Convolutional Neural Network for web security;Jemal;Comput. Commun.,2021
2. RAT: Reinforcement-Learning-Driven and Adaptive Testing for Vulnerability Discovery in Web Application Firewalls;Amouei;IEEE Trans. Dependable Secur. Comput.,2021
3. van der Stock, A., Glas, B., Smithline, N., and Gigler, T. (2022, August 04). OWASP Top 10:2021. Available online: https://owasp.org/www-project-top-ten/.
4. An Improved LSTM-PCA Ensemble Classifier for SQL Injection and XSS Attack Detection;Stiawan;Comput. Syst. Sci. Eng.,2023
5. (2021, August 01). SQLMAP: Automatic SQL Injection and Database Takeover Tool. Available online: https://sqlmap.org/.
Cited by
1 articles.
订阅此论文施引文献
订阅此论文施引文献,注册后可以免费订阅5篇论文的施引文献,订阅后可以查看论文全部施引文献