SQL-IDS: evaluation of SQLi attack detection and classification based on machine learning techniques

Sheykhkanloo, Naghmeh Moradpoor

Abstract

Structured Query Language injection (SQLi) attack is a code injection technique where malicious SQL statements are inserted into a given SQL database by simply using a web browser. Injected SQL commands can alter the database and thus compromise the security of a web application. In our previous work, we proposed an effective pattern recognition Neural Network (NN) model for detection and classification of the SQLi attacks. Our proposed model was built from: a Uniform Resource Locator (URL) generator, a URL classifier, and a NN model. The URL generator was implemented in order to generate thousands of malicious and benign URLs. The URL classifier was employed in order to identify each URL, which was generated by the URL generator, as either a benign URL or a malicious URL. The URL classifier also pigeonholed the malicious URLs into seven popular SQLi attack categories. The NN model includes n hidden layers with x input and y output nodes where the benign and malicious URLs were employed for training, validating, and testing phases. Addressing our previous captured results, our proposed pattern recognition NN model for the detection and classification of the SQLi attacks demonstrated a good performance in terms of accuracy, true-positive rate, and false-positive rate. In this paper, we stress test our previous proposal in order to prove the effectiveness of our proposed approach.

• Presentation Conference Type: Conference Paper (Published)
• Conference Name: 8th International Conference on Security of Information and Networks - SIN '15
• Start Date: Sep 8, 2015
• End Date: Sep 10, 2015
• Online Publication Date: Sep 8, 2015
• Publication Date: 2015
• Deposit Date: Jan 12, 2017
• Publisher: Association for Computing Machinery (ACM)
• Book Title: SIN '15 Proceedings of the 8th International Conference on Security of Information and Networks
• ISBN: 9781450334532
• DOI: https://doi.org/10.1145/2799979.2800011
• Keywords: Intrusion Detection, SQL injection attacks, machine learning, Artificial Intelligence, pattern recognition, Neural Networks, Web Attacks
• Public URL: http://researchrepository.napier.ac.uk/Output/461469