Title: Securing web applications from SQLIA using progressive detector

Authors: N. Gunaseeli; D. Jeya Mala

Addresses: Department of Computer Applications, K.L.N College of Engineering, Pottapalayam, Sivagangai District, Tamil Nadu, India ' Thiagarajar College of Engineering, Madurai, Madurai District, Tamil Nadu, India

Abstract: Web applications are distributed applications that are stored on a server and delivered to users over the internet. Many people enjoy its utilisation due its benefits such as global access, cost saving, faster delivery of products and opportunities to manage the business from anywhere in the world. The users of web applications expect that the web applications should be secure and reliable, while doing their online transactions. But, modern web applications face threats like cross-site scripting, cookie poisoning, buffer overflow etc. Among the attacks of web applications, SQLIA is one of the most significant of such threats. SQL injection attack is a type of injection attack (SQLIA), in which SQL commands are injected as data-plane input in order to affect the execution of predefined SQL commands. SQL injection is a code injection technique that exploits the security vulnerability occurring in the database layer of an application. It allows attackers to get unauthorised access to the back-end database consisting of confidential user information. The paper presents a novel approach and it prevents all types of SQLIAs with minimum time frame. The proposed system aims at preventing all types of SQLIA by quick identification of malicious query at run time. This novel approach has been framed with the progressive detector (PD) tool and carried out on real time web applications. The experimental results clearly show that the Progressive Detector prevents all kinds of SQLIAs with minimum time frames.

Keywords: software engineering; software security; database security; SQL injection; run time monitoring; vulnerabilities; web applications.

DOI: 10.1504/IJISCM.2017.086227

International Journal of Information Systems and Change Management, 2017 Vol.9 No.1, pp.44 - 69

Received: 01 Jun 2016
Accepted: 17 Mar 2017
Published online: 03 Sep 2017 *

Full-text access for editors Full-text access for subscribers Purchase this article Comment on this article