A detection model for SQL injection attack. Issue 2 (2015)

• Record Type: Journal Article
• Authors: Chen, Yizhang; Wang, Dan; Fu, Lihua
• Is Part Of: International journal of collaborative intelligence. Volume 1:Issue 2(2015)
• Page Start: 137
• Page End: 152
• Publication Date: 2015
• Subjects: SQL injection attacks -- taint -- attack detection -- white list -- black list -- flow tracking -- network security -- website vulnerability -- intrusion detection; Computational intelligence -- Periodicals; Cognitive science -- Periodicals; Information science -- Periodicals; 006.305
• Languages: English
• ISSNs: 2051-7122

Abstract

Among all attacks on the web application system, SQL injection is one of the most serious security issues. Combining the dynamic and static information flow tracking technology, dynamic taint-based tracking technology and white list and black list, this paper designs and implements a prevention model of SQL injection attacks, which can effectively prevent three major types of SQL injection attacks and block the frequent SQL injection as well as support single/batch website scanning and generate scanning reports in HTML format. Multi-thread mechanism is adopted to improve program performance as well as acquiring much information about vulnerability. Testing proved that it can effectively prevent three types of SQL injection attacks, and effectively block frequent SQL injection attacks, helping users confirm the information about SQL injection vulnerability in single/batch websites through the returned information.