Skip to main content

Research Repository

Advanced Search

Numerical encoding to tame SQL injection attacks

Uwagbole, Solomon; Buchanan, William J.; Fan, Lu


Solomon Uwagbole

Lu Fan


Recent years have seen an astronomical rise in SQL Injection Attacks (SQLIAs) used to compromise the confidentiality, authentication and integrity of organisations’ databases. Intruders becoming smarter in obfuscating web requests to evade detection combined with increasing volumes of web traffic from the Internet of Things (IoT), cloud-hosted and on-premise business applications have made it evident that the existing approaches of mostly static signature lack the ability to cope with novel signatures. A SQLIA detection and prevention solution can be achieved through exploring an alternative bio-inspired supervised learning approach that uses input of labelled dataset of numerical attributes in classifying true positives and negatives. We present in this paper a Numerical Encoding to Tame SQLIA (NETSQLIA) that implements a proof of concept for scalable numerical encoding of features to a dataset attributes with labelled class obtained from deep web traffic analysis. In the numerical attributes encoding: the model leverages proxy in the interception and decryption of web traffic. The intercepted web requests are then assembled for front-end SQL parsing and pattern matching by applying traditional Non-Deterministic Finite Automaton (NFA). This paper is intended for a technique of numerical attributes extraction of any size primed as an input dataset to an Artificial Neural Network (ANN) and statistical Machine Learning (ML) algorithms implemented using Two-Class Averaged Perceptron (TCAP) and Two-Class Logistic Regression (TCLR) respectively. This methodology then forms the subject of the empirical evaluation of the suitability of this model in the accurate classification of both legitimate web requests and SQLIA payloads.

Presentation Conference Type Conference Paper (Published)
Conference Name 2ND IEEE/IFIP Workshop on Security for Emerging Distributed Network Technologies (DISSECT)
Start Date Apr 29, 2016
End Date Apr 29, 2016
Acceptance Date Apr 29, 2016
Publication Date Jul 4, 2016
Deposit Date Jul 7, 2016
Publicly Available Date Jul 7, 2016
Publisher Institute of Electrical and Electronics Engineers
Peer Reviewed Peer Reviewed
Series ISSN 2374-9709
Book Title 2016 IEEE/IFIP Network Operations and Management Symposium (NOMS),
ISBN 978-1-5090-0223-8
Keywords NETSQLIA; SQLIA; numerical attributes encoding; SQL Injection; SQLIA neurons;
Public URL
Contract Date Jul 7, 2016


Numerical encoding to Tame SQL injection attacks (927 Kb)

Copyright Statement
© © 2016 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works

You might also like

Downloadable Citations