Title: A detection model for SQL injection attack

Authors: Yizhang Chen; Dan Wang; Lihua Fu

Addresses: College of Computer Science, Beijing University of Technology, Beijing, China ' College of Computer Science, Beijing University of Technology, Beijing, China ' College of Computer Science, Beijing University of Technology, Beijing, China

Abstract: Among all attacks on the web application system, SQL injection is one of the most serious security issues. Combining the dynamic and static information flow tracking technology, dynamic taint-based tracking technology and white list and black list, this paper designs and implements a prevention model of SQL injection attacks, which can effectively prevent three major types of SQL injection attacks and block the frequent SQL injection as well as support single/batch website scanning and generate scanning reports in HTML format. Multi-thread mechanism is adopted to improve program performance as well as acquiring much information about vulnerability. Testing proved that it can effectively prevent three types of SQL injection attacks, and effectively block frequent SQL injection attacks, helping users confirm the information about SQL injection vulnerability in single/batch websites through the returned information.

Keywords: SQL injection attacks; taint; attack detection; white list; black list; flow tracking; network security; website vulnerability; intrusion detection.

DOI: 10.1504/IJCI.2015.071219

International Journal of Collaborative Intelligence, 2015 Vol.1 No.2, pp.137 - 152

Received: 23 Dec 2014
Accepted: 26 Jan 2015
Published online: 17 Aug 2015 *

Full-text access for editors Full-text access for subscribers Purchase this article Comment on this article