Journal
INTERNATIONAL JOURNAL OF INFORMATION SECURITY
Volume 18, Issue 1, Pages 1-22Publisher
SPRINGER
DOI: 10.1007/s10207-017-0393-x
Keywords
Web-application; SQL injection; Naive Bayes; SVM; Tree-based; Edit-distance; Classification
Ask authors/readers for more resources
Whenever web-application executes dynamic SQL statements it may come under SQL injection attack. To evaluate the existing practices of its detection, we consider two different security scenarios for the web-application authentication that generates dynamic SQL query with the user input data. Accordingly, we generate two different datasets by considering all possible vulnerabilities in the run-time queries. We present proposed approach based on edit-distance to classify a dynamic SQL query as normal or malicious using web-profile prepared with the dynamic SQL queries during training phase. We evaluate the dataset using proposed approach and some well-known supervised classification approaches. Our proposed method is found more effective in detecting SQL injection attack under both the scenarios of authentication security.
Authors
I am an author on this paper
Click your name to claim this paper and add it to your profile.
Reviews
Recommended
No Data Available