A Learning-based Neural Network Model for the Detection and Classification of SQL Injection Attacks

Sheykhkanloo, Naghmeh Moradpoor

Abstract

Structured Query Language injection (SQLi) attack is a code injection technique where hackers inject SQL commands into a database via a vulnerable web application. Injected SQL commands can modify the back-end SQL database and thus compromise the security of a web application. In the previous publications, the author has proposed a Neural Network (NN)-based model for detections and classifications of the SQLi attacks. The proposed model was built from three elements: 1) a Uniform Resource Locator (URL) generator, 2) a URL classifier, and 3) a NN model. The proposed model was successful to: 1) detect each generated URL as either a benign URL or a malicious, and 2) identify the type of SQLi attack for each malicious URL. The published results proved the effectiveness of the proposal. In this paper, the author re-evaluates the performance of the proposal through two scenarios using controversial data sets. The results of the experiments are presented in order to demonstrate the effectiveness of the proposed model in terms of accuracy, true-positive rate as well as false-positive rate.

• Journal Article Type: Article
• Acceptance Date: Feb 18, 2017
• Online Publication Date: Apr 1, 2017
• Publication Date: 2017-04
• Deposit Date: Feb 28, 2017
• Publicly Available Date: Mar 2, 2017
• Journal: International Journal of Cyber Warfare and Terrorism
• Print ISSN: 1947-3435
• Electronic ISSN: 1947-3443
• Publisher: IGI Global
• Peer Reviewed: Peer Reviewed
• Volume: 7
• Issue: 2
• Pages: 16-41
• DOI: https://doi.org/10.4018/ijcwt.2017040102
• Keywords: Intrusion Detection, SQL injection attacks, machine; learning, Artificial Intelligence, Neural Networks, Web Attacks,; Databases
• Public URL: http://researchrepository.napier.ac.uk/Output/690701
• Contract Date: Feb 28, 2017