An Efficient Model to Detect and Prevent SQL Injection Attack
DOI:
https://doi.org/10.54388/jkues.v2i1.225Keywords:
SQL injection, Web applications security, Proxy serverAbstract
SQL injection attack (SQLIA) is considered one of most threats used to attack web applications. Therefore, attackers used SQL injection vulnerability to gain ultimate access to databases that belong to applications and expose their sensitive information. Thus, attackers use SQL injections vulnerability to manipulate data also it could be used to take full control of the target machine. Accordingly, several methods were proposed in the literature to address this vulnerability widely because of its importance and high impact on the security of web applications.Thus, we propose a model to detect and prevent SQL injection attack, which uses runtime validation to detect the occurrence of such attacks, our proposed model is adaptable to any existing system, with no need to modify the client or server and either no need to know web application source code. Furthermore, the modification independence is done by adding additional middleware between client and server. Thus, any check process is done on this middleware, and it is represented as a proxy that can do sanitize the inputs for detecting and preventing SQLIA.Furthermore, our proposed model accuracy reaches 86.6% for detecting and preventing SQLIA.
References
Zain Marashdeh, Khaled Suwais, and Mohammad Alia. A survey on sql injection attack: Detection and challenges. In 2021 International Conference on Information Technology (ICIT), pages 957–962. IEEE, 2021.
Jianwei Hu, Wei Zhao, and Yanpeng Cui. A survey on sql injection attacks, detection and prevention. In Proceedings of the 2020 12th International Conference on Machine Learning and Computing, pages 483–488, 2020.
Rashad Elhabob, Abdalla Adel, Nabeil Eltayieb, Alzubier Hassan, and Mohamed AH Damos. An efficient signcryption scheme for vehicular satellite-based networks. Journal of Karary University for Engineering and Science, 2021.
Zar Chi Su Su Hlaing and Myo Khaing. A detection and prevention technique on sql injection attacks. In 2020 IEEE Conference on Computer Applications (ICCA), pages 1–6. IEEE, 2020.
Rajashree A Katole, Swati S Sherekar, and Vilas M Thakare. Detection of sql injection attacks by removing the parameter values of sql query. In 2018 2nd International Conference on Inventive Systems and Control (ICISC), pages 736–741. IEEE, 2018.
Sonam Bhardwaj and Mayank Dave. Sql injection attack detection, evidence collection, and notifying system using standard intrusion detection system in network forensics. In Proceedings of International Conference on Computational Intelligence, Data Science and Cloud Computing, pages 681–692. Springer, 2021.
Abdelrhman Hassan, Rashad Elhabob, Umar Ibrahim, and Yong Wang. Efficient public key cryptography scheme with equality test for heterogeneous systems in iiot. In International Conference on Security, Privacy and Anonymity in Computation, Communication and Storage, pages 108–121. Springer, 2020.
Dave Wichers and Jeff Williams. Owasp top-10 2017. OWASP Foundation, 3:4, 2017.
Ibm x-force 2012 report. IBM Foundation, 2012.
Mamdouh Alenezi, Muhammad Nadeem, and Raja Asif. Sql injection attacks countermeasures assessments. Indonesian Journal of Electrical Engineering and Computer Science, 21(2):1121–1131, 2021.
Jeklin Harefa, Gredion Prajena, Abdillah Muhamad Alexander, Edmundus Valin Setia Dewa, and Sena Yuliandry. Sea waf: The prevention of sql injection attacks on web applications. Advances in Science, Technology and Engineering Systems, 6:405–411, 2021.
Neelima Bayyapu. Sql injection attacks and mitigation strategies: The latest comprehension. In Advances in Cybersecurity Management, pages 199–220. Springer, 2021.
Rashad Elhabob, Yanan Zhao, Iva Sella, and Hu Xiong. Public key encryption with equality test for heterogeneous systems in cloud computing. KSII Transactions on Internet and Information Systems (TIIS), 13(9):4742–4770, 2019.
Rasoul Jahanshahi, Adam Doupe, and Manuel Egele. You shall not ´ pass: Mitigating sql injection attacks on legacy web applications. In Proceedings of the 15th ACM Asia Conference on Computer and Communications Security, pages 445–457, 2020.
Shravan Singh and Ankit Kumar. Detection and prevention of sql injection. International Journal of Scientific Research & Engineering Trends, 6(3):1642–1645, 2020.
Neha Bhateja, Sunil Sikka, and Anshu Malhotra. A review of sql injection attack and various detection approaches. Smart and Sustainable Intelligent Systems, pages 481–489, 2021.
Rashad Elhabob, Yanan Zhao, Iva Sella, and Hu Xiong. Efficient certificateless public key cryptography with equality test for internet of vehicles. IEEE Access, 7:68957–68969, 2019.
Hanan Alsobhi and Reem Alshareef. Sql injection countermeasures methods. In 2020 International Conference on Computing and Information Technology (ICCIT-1441), pages 1–4. IEEE, 2020.
Zainab S Alwan and Manal F Younis. Detection and prevention of sql injection attack: A survey. International Journal of Computer Science and Mobile Computing, 6(8):5–17, 2017.
Rui Filipe Silva, Raul Barbosa, and Jorge Bernardino. Intrusion detection systems for mitigating sql injection attacks: review and state-of-practice. International Journal of Information Security and Privacy (IJISP), 14(2):20–40, 2020.
Nabeil Eltayieb, Rashad Elhabob, Alzubair Hassan, and Fagen Li. Finegrained attribute-based encryption scheme supporting equality test. In International Conference on Algorithms and Architectures for Parallel Processing, pages 220–233. Springer, 2018.
Sruthi Bandhakavi, Prithvi Bisht, P Madhusudan, and VN Venkatakrishnan. Candid: preventing sql injection attacks using dynamic candidate evaluations. In Proceedings of the 14th ACM conference on Computer and communications security, pages 12–24, 2007.
Indrani Balasundaram and E Ramaraj. An efficient technique for detection and prevention of sql injection attack using ascii based string matching. Procedia Engineering, 30:183–190, 2012.
Kumar Shubham, Rajeev. Attacks due to sql injection and their prevention method for web-application. International Journal of Computer Science and Information Technologies (IJCSIT), 3, 2012.
Farhaan Kaleem. Securing Credentials from SQL Injection Attack Using Encryption and Hashing. PhD thesis, Dublin, National College of Ireland, 2019.
MHAS Medhane. Efficient solution for sql injection attack detection and prevention. International Journal of Soft Computing and Engineering (IJSCE), 3:396–398, 2013.
Muhammad Saidu Aliero, Imran Ghani, Kashif Naseer Qureshi, and Mohd Foad Rohani. An algorithm for detecting sql injection vulnerability using black-box testing. Journal of Ambient Intelligence and Humanized Computing, 11(1):249–266, 2020.
Haifeng Gu, Jianning Zhang, Tian Liu, Ming Hu, Junlong Zhou, Tongquan Wei, and Mingsong Chen. Diava: a traffic-based framework for detection of sql injection attacks and vulnerability analysis of leaked data. IEEE Transactions on Reliability, 69(1):188–202, 2019.
Sql injection dataset. https://www.kaggle.com/syedsaqlainhussain/ sql-injection-dataset. Accessed: 2020-12-10.
