Application layer intrusion detection for SQL injection

SQL injection attacks potentially affect all applications, especially web applications, that utilize a database backend. While these attacks are generally against the applications and not the database directly, there are some techniques that can be deployed to mitigate the risk at the database server. Database intrusion detection systems are often based on signatures of known exploits and honey tokens, traps set in the database. This paper examines the threat from SQL injection attacks, the reasons traditional database access control is not sufficient to stop them, and some of the techniques used to detect them. Moreover, it proposes a model for an anomalous SQL detector which observes the database traffic from the perspective of the database server itself. The proposed anomaly model can be used in conjunction with the existing methods to give the database server a way to mitigate the SQL injection risk that is a major application security problem. Keywords SQL injection, database s...

• Type: Conference
• Year: 2006
• Where: ACMSE
• Authors: Frank S. Rietta
• Keywords: ACMSE 2006, Database, SQL Injection, SQL Injection Attacks, Theoretical Computer Science