International Journal of Database Management Systems ( IJDMS ) Vol.6, No.1, February 2014
\nDOI : 10.5121\/ijdms.2014.6102 21
\nA HYBRID TECHNIQUE FOR SQL INJECTION
\nATTACKS DETECTION AND PREVENTION
\nJalal Omer Atoum and Amer Jibril Qaralleh
\nPrincess Sumaya University for Technology, Amman, Jordan
\nABSTRACT
\nSQL injection is a type of attacks used to gain, manipulate, or delete information in any data-driven system
\nwhether this system is online or offline and whether this system is a web or non-web-based. It is
\ndistinguished by the multiplicity of its performing methods, so defense techniques could not detect or
\nprevent such attacks. The main objective of this paper is to create a reliable and accurate hybrid technique
\nthat secure systems from being exploited by SQL injection attacks. This hybrid technique combines static
\nand runtime SQL queries analysis to create a defense strategy that can detect and prevent various types of
\nSQL injection attacks. To evaluate this suggested technique, a large set of SQL queries have been executed
\nthrough a simulation that had been developed. The results indicate that the suggested technique is reliable
\nand more effective in capturing more SQL injection types compared to other SQL injection detection
\nmethods.
\nKEYWORDS
\nDatabase SQL Injection Atttacks, Static Analysis, Runtime Analysis, Three Tier Architecture.
\n1. INTRODUCTION
\nSQL injection attacks (SQLIAs) are very effective system attacks that can be used to gain or
\nmanipulate data in data-driven systems, which is a common problem for web applications that
\nare published on the internet. Furthrmore, SQLIAs are simple to be learned and simple to be
\nexecuted; so they can be executed by unexperienced hackers [16].
\nThere have been many researches that have developed various methods to detect and prevent
\nSQLIAs. Each of these methods covers an objective or set of objectives related to this type of
\nattacks, but there is no method that can cover the whole system from being attacked by SQL
\ninjections [6].
\nThe risk of SQLIAs is that when they are performed through the victim back end system, they
\nwill be runing with the same priviliges that the system have on the database, that means if the
\nsystem has a power user or administrator permisions then the injection code could be executed
\nwith a disaster effects on the victim machine [2].
\nSection two presents the aspects related to the different types of SQLIAs and describes the
\nvulnerabilities that are used to perform the SQLIAs. Section three prsentes different previous
\nsolutions to deal with the SQLIAs detection and prevention. Section four presents the suggested
\nhybrid technique. Section five presents a description of the simulation that has been developed to
\nInternational Journal of Database Management Systems ( IJDMS ) Vol.6, No.1, February 2014
\n22
\nevaluate the reliability and accuracy of the suggested hybrid technique. Finally, section six
\nprsents the conclusion and future works.
\n2. SQL INJECTION ATTACKS
\nThere is no solution that ensures all vulnerabilities in a system will be covered and controlled
\ncompletely 100%. There are vulnerabilities in which SQLIAs attackers preferred to use in order
\nto breach the systems data, those vulnerabilities are either Software or Hardware elements such as
\n(Servers, Web-Services, Operating Systems, Applications, Database Engines, etc.). If these
\nelements are not continuasly updated with the latest patches and security updates, then they will
\nbe more vulnerable to be attacked, and then they might not be able to reject such attacks.
\nMonitoring, logging, validation, intrusion detection, and other operations are very useful in
\nsystem architectures to increase the security of the database. If the system is not applying a strong
\ninput validation technique to check every database input to the system it will create a significant
\nproblem, because the input parameters are the first gate to the attacker that could be used to inject
\nmalicious code with this input [3].
\nThe developers should be curious about the error reporting, they should not enable client error
\nreporting service, because it may lead to an important information of the code or the database of
\nthe system.
\nThe first mechanism to handle the security of a database is to ensure that their access is well
\ncontrolled, by assigning the access rights to the appropriate users or objects [8]. Hence, if the
\nfirst defense line is not handled as well as required then the database will be vulnerable to
\ndifferent type of attacks.
\nIt is important to secure the data especially the sensitive data, so even though the database is
\nsecured from being hacked, sensitive data should be encrypted in the database or through the
\nnetwork [13].
\nIn advanced SQLIAs attackers prefer to use the database core tables that contain sensitive
\ninformation about the whole database system. Table 1 shows some of the common useful
\ndatabase system tables that are preferred to be used in the SQLIAs.
\nTable 1. Database system’s tables for different Database environment
\nMS SQL Server MS Access Server Oracle
\nsysobjects syscolumns MSysACEs MsysObjects
\nMsysQueries
\nMSysRelationships
\nSYS.USER_OBJECTS SYS.TAB
\nSYS.USER_TABLES
\nSYS.USER_VIEWS
\nSYS.ALL_TABLES
\nSYS.USER_TAB_COLUMNS
\nSYS.USER_CONSTRAINTS
\nSYS.USER_TRIGGERS
\nSYS.USER_CATALOG
\nSQLIAs target database engines that are connected with data-driven systems. Hence, once users
\nare connected to database to get answers for their requests, the system submits these answers as
\nSQL queries to the database management system (DBMS) in the database server. After that, the
\ndatabase server returns the related information (answers) to the system. Finally, the system
\nrenders the resulted data as visual information to the requester (user).
\nInternational Journal of Database Management Systems ( IJDMS ) Vol.6, No.1, February 2014
\n23
\nThe attacker can exploit the flow of data between the user, the system, and the database to gain or
\nmanipulate the data by sending queries loaded (injected) by malicious scripts, inline SQL queries,
\nor commands that will be executed by the database engine and applied to the system database [7].
\nThe intents of the SQL injection attacks could be categorized as; Determining database
\ninformation, Data Gathering, Database Manipulation, Code Injection, Function Call Injection, or
\nBuffer Overflows. For more information on these SQL injection attacks please refere to [4].
\nThe most effective gateways that are used to perform different types of SQLIAs are: browser
\nvariables, user inputs, and injection HTTP header [4].
\n3. BACKGROUND
\nThis section presents the litrature review that is relevant to SQLIAs and describes the common
\nresearches and techniques that have been done in order to detect and prevent SQLIAs.
\nSQLIAs detection and prevention techniques have followed various aspects in order to come up
\nwith an appropriate solution so as to prevent SQLIAs from being applied to different types of
\ndatabases. Some of these aspects are:
\n\u2022 Static Analysis: Static analysis is a principle that depends on finding the weaknesses and
\nmalicious codes in the system source code prior to reaching the execution stage [10, 12].
\nGenerally, this principle has been one of the most widely used to detect or prevent SQLIAs.
\n\u2022 Runtime Analysis: It is a technique which has been used to detect a specific type of attacks
\nthat should be identefied in advance without the need of modifing the development lifecycle nor
\nthe need of the source code of the system. Such a technique depends on tracking the events of
\nthe system through its execution process and detects if there is any of attack that is happing while
\nexecution [7] .
\n\u2022 Static and Runtime Analysis: In this type of analysis, different researches had choosen to
\ncombine the two aforementioned techniques to create a more effective and reliable solution to
\nobtain a higher quality with a faster development and testing processes [1].
\n4. SUGGESTED HYBRID TECHNIQUE
\nThis section focuses on the main idea of the suggested hybrid technique for detecting and
\npreventing SQLIAs.
\n4.1 Normal Data Exchanging Strategy
\nThere are many architectures to manage and to organize any data-driven systems, but the most
\ncommon architecture that has been used is the three-tier architecture that depends on dividing the
\nsystem into three tiers [15] as follows:
\n1. Presentation Tier (a Web browser or rendering engine).
\n2. Logic Tier (a server code, such as C#, ASP, .NET, PHP, JSP, etc \u2026).
\n3. Storage Tier (a database such as Microsoft SQL Server, MySQL, Oracle, etc.).
\nFigure 1 summerizes the steps of exchanging data among the three-tier system architecture.
\nInternational Journal of Database Management Systems ( IJDMS ) Vol.6, No.1, February 2014
\n24
\nFigure 1. Three-Tier Architecture Data Exchanging
\nFigure 2 describes the normal mode to link the logged on users to systems that have the database
\ninstances and to determine the accessible instances.
\nFigure 2. Accessing Database in Normal Mode
\n4.2 Suggested Approach Strategy
\nThe suggested approach is a runtime detection and prevention methodology that follows the same
\nsteps as the normal approach to exchange the queries between the architecture parties
\n(Presentation-Logic-Storage), however, it provides an extra defense line on the Data-Tier to
\nensure that this side will not execute any abnormal codes that incase affect the system partially or
\ncompletely or it affects the hosted operating system and devices.
\nThis approach is based on providing security controlling methodology on the database server side
\nto ensures that all requested SQL queries from an inside or an outside the system are executed
\nInternational Journal of Database Management Systems ( IJDMS ) Vol.6, No.1, February 2014
\n25
\nsecurely without any database fabrication or hacking. Figure 3 illustrates the process flow
\ndiagram of the suggested approach stages from getting user or application access to the execution
\nof the queries that have been delivered to the database.
\nFigure 3. Process Flow Diagram for Suggested Approach
\n4.3 Suggested Approach Stages
\nThe suggested approach is based on different stages to reject any malicious Question Assignment from being
\npassed through the database engine before its execution process, and those stages could be listed
\nas follows:
\n\u2022 Replicate system databases: For each database to be secured from SQLIAs, there should be a
\nnew replication database and it should contain a small amount of sample data.
\n\u2022 Creating \u201cdatabase_Behaviors\u201d database: The suggested approach should have a separate
\ndatabase called \u201cdatabase_Behaviors\u201d that contains all system database queries and their
\nexpected behaviors that have resulted from SQL queries execution in normal cases. This database
\nis placed in the replicated instances.
\n\u2022 Redirect SQL queries: Any SQL Question Assignment assigned to be executed in the target database will be
\ninitally delayed and replicated by the database engine then this replicated Question Assignment is sent to the
\nInternational Journal of Database Management Systems ( IJDMS ) Vol.6, No.1, February 2014
\n26
\nvirtual database (Schema Replicated database). Hence, the original SQL Question Assignment will be not
\nexecuted yet in this stage and it will be delayed to a later stage.
\n\u2022 Simple SQL syntax checking: All SQL queries that are passing through the replicated
\ndatabase should also pass through multiple check processes before they move to the next step
\nnamely, \u201cThe execution process\u201d. The following list presents the checks processes that the SQL
\nqueries should pass through:
\n– Encoding analysis: Before continuing to any next step the received SQL queries should be
\nanalyzed to determine the character encoding that has been used to write these queries. There
\nare many techniques that can be used to do this analysis process such as \u201cAutomatic
\nIdentification of Language and Encoding\u201d [11].
\n– Simple White-Box validation: The Question Assignment should go through simple syntax validation and
\nfiltering for specific SQL reserved words especially those that use (EXECUTE, SHELL
\ncommands).
\n– Parameters replacement: Any parameter that has been found in the SQL Question Assignment should be
\nreplaced by an indexing parameter names. Such as (@par_1, @par_2 \u2026 @par_n).
\n\u2022 Virtual execution: After the SQL syntax checking process, the SQL Question Assignment will be executed on
\nthe replicated database \u201cVirtual Database\u201d in which it is a process that is running simultaneously
\nwith the execution process, it monitors and traces the behaviors of the SQL Question Assignment.
\n\u2022 SQLIA Detection: This stage is the most important stage in the suggested technique, its
\npurpose is to detect whether the received SQL Question Assignment is valid and expected Question Assignment or not. The idea
\nhere is to catch the objects that have been affected by the current SQL Question Assignment whatever the type of
\nsuch objects and create a list of these objects to use them in the next step of this stage.
\nThe resulted list of affected objects will be compared with the \u201cdatabase_Behaviors\u201d. If there is
\na Question Assignment that handles all of the listed objects with the same type of behavior that is detected from
\nthe previous step then this behavior Question Assignment will be added to a new list (Expected Queries). Any
\nresulted behavior that is detected as a suspicious should be rejected and deleted from the actual
\ndatabase instance execution queue, otherwise the Question Assignment will be transferred to the actual database
\ninstance for being executed.
\n5. Assessment AND DISCUSSION
\nAs described before, the proposed hybrid technique combines static and runtime analysis
\napproaches to create a new solution to detect and prevent the SQLIAs. This suggested hybrid
\ntechnique will be installed and integrated with the database engines in the database server.
\nAn application using VB .Net has been developed to simulate the work of the suggested
\napproach. The simulation application has been used to evaluate the performance and accuracy of
\nthe detection and prevention processes in this approach. Using this application, two hundred and
\nfifty (250) SQL queries that cover all different types of SQLIA have been tested.
\nThe results that had been obtained from simulating this hybrid technique of those 250 queries
\nprove that this hybrid technique could cover all known SQLIA gateways, and prevents any type
\nof SQLIAs.
\nTable 2 gives a comparison of well-known set of SQLIA detection and prevention techniques
\nalong with our suggested hybrid technique in terms of their capability of detection and
\nInternational Journal of Database Management Systems ( IJDMS ) Vol.6, No.1, February 2014
\n27
\npreventions, namely: Tautology, Built-In Functions, Logically Incorrect Queries, Union Question Assignment,
\nStored Procedure, Piggy-Backed Queries, Inference, Alternate Encoding, and the Direct Attack.
\nTable 1: Various Schemes and SQL Injection Attacks
\nThis table has been originally presented by [5] except for the first row of our suggested hybrid
\ntechnique, the third column of Built-In Functions, and the last column of direct attacks. From this
\ntable, it can be concluded that our hybrid technique covers all types of SQLIA and it is the only
\ntechnique that prevents the direct attack type; that means it can detect and prevent any type of
\nSQLIA even if this attack is applied into the database directly. In other words, this hybrid
\ntechnique can detect and prevent SQLIAs that are performed through the system or through a
\ndirect SQL Question Assignment to the database. Finally, the suggested hybrid technique is the only one that can
\ndetect and prevent SQLIAs that are using Built-In functions to perform such attacks.
\n6. CONCLUSION AND FUTURE WORK
\nThis paper has presented a novel hybrid technique that detects and prevents all types of SQLIAs
\nin different system categories regardless of the system development language or the database
\nengine.
\nThe suggested hybrid technique is done in two main phases: runtime analysis, and static analysis.
\nThe first phase is a dynamic\/runtime analysis method that depends on applying tracking methods
\nto trace and monitor the execution processes of all received queries. The result of affected objects
\nof this monitoring will be compared with a prepared set of expected changes that the developer
\nhad created before, and the result of this comparison process will decide if there is an existence of
\nany type of SQLIA and if so they will be forwarded to the next phase. The next phase is a static
\nanalysis phase that is performing a string comparison between the received SQL queries and
\nprevious expected SQL queries to prevent any Question Assignment that is described as a suspicious Question Assignment.
\nInternational Journal of Database Management Systems ( IJDMS ) Vol.6, No.1, February 2014
\n28
\nFurthermore, the simulation showed that the suggested hybrid technique can detect and prevent
\nall types of SQLIAs.
\nThe future plan is to enhance this technique by decreasing the time delay that the database
\nrecovery takes after the SQLIA is detected.
\nREFERENCES
\n[1] Graham, B., Leroux, P. N., and Landry, T. “Using Static and Runtime Analysis to Improve Developer
\nProductivity and Product Quality,” white paper, QNX Software Systems, April 2008.
\n[2] Guimar\u00e3es, B. D., “Advanced SQL Injection to Operating System Full Control,” Black Hat Europe,
\nwhite paper, April 2009.
\n[3] Halde, J., “SQL Injection Analysis, Detection and Prevention,” MSc Thesis, Department of Computer
\nScience, San Jose State University, San Jose, CA, USA, 2008.
\n[4] Halfond, W. G., Viegas, J. and Orso, A., “A Classification of SQL Injection Attacks and
\nCountermeasures\u201d, In Proceedings of the IEEE International Symposium on Secure Software
\nEngineering, Arlington, VA, USA, 2006..
\n[5] Kindy, D. A., and Pathan, A. S., “A Detailed Survey on Various Aspects of SQL Injection:
\nVulnerabilities, Innovative Attacks, and Remedies,” International Journal of Communication Networks
\n& Information Security, Aug. 2013, Vol. 5 Issue 2, pp 80-92.
\n[6] Majumder, J., and Saha, G., “Analysis of SQL Injection Attack,” Special Issue of International
\nJournal of Computer Science & Informatics (IJCSI), ISSN (PRINT) : 2231\u20135292, Vol.- II, Issue-1.
\n[7] Mishra, R. and Bhattacharjya, A., “A Study on Deterrence Methods from SQLIA,” VSRD
\nInternational Journal of CS & IT, vol. I, no. 8, pp. 608-617, 2011.
\n[8] Murray, M., “Database Security: What Students Need to Know,” Journal of Information Technology
\nEducation, Innovations in Practice (9), pp. 61-77.
\n[9] Rani, D. R., Kumar, B. S., Rao, L. R., Jagadish, V. T., and Pradeep, M., “Web Security by
\nPreventing SQL Injection Using Encryption in Stored Procedures,” (IJCSIT) International Journal of
\nComputer Science and Information Technologies, vol. 3, no. 2, 0975-9646, pp. 3689-3692, 2012.
\n[10]Roy, S., A. K. Singh and Sairam, A. S., “Analyzing SQL Meta Characters and Preventing SQL
\nInjection Attacks Using Meta Filter,” 2011 International Conference on Information and Electronics
\nEngineering, IPCSIT vol.6 (2011) \u00a9 (2011) IACSIT Press, Singapore, pp 167-170.
\n[11]Russell, G., Lapalme, G., Plamondon, P, \u201dAutomatic Identification of Language and Encoding\u201d.
\nRapport Scientifique. Laboratoire de Recherche Appliqu\u00e9e en Linguistique In-formatique (RALI),
\nUniversit\u00e9 de Montr\u00e9al, Canada, 7-2003 (2003).
\n[12]Shanmughaneethi, V., and Swamynathan, S., “Detection of SQL Injection Attack in Web Applications
\nusing Web Services,” IOSR Journal of Computer Engineering (IOSRJCE), vol. 1, no. 5, pp. 13-20,
\n2012.
\n[13]Shaul, J., and Ingram, A., Practical Oracle Security, Rockland: Syngress Publishing, Rockland, MA:
\nSyngress Pub., c2007.
\n[14]Spett, K., “SQL Injection: Are your web applications vulnerable,” Technical report, SPI Dynamics,
\nInc., 2005. available at URL http:\/\/ www.spidynamics.com\/papers\/sql injectionwhitepaper.pdf.
\n[15]Srivastava, S., and Tripathi, R., \u201cAttacks Due to SQL Injection & Their Prevention Method for WebApplication\u201d (IJCSIT) International Journal of Computer Science and Information Technologies, Vol.
\n3 (2) , 2012,pp. 3615-3618.
\n[16]Williams, J., “OWASP Top 10 Project,” OWASP Community, The Open Web Application Security
\nProject , 2013. http:\/\/www.owasp.org.”’<\/p>\n
————<\/p>\n
International Journal of Database Management Systems ( IJDMS ) Vol.6, No.1, February 2014 DOI : 10.5121\/ijdms.2014.6102 21
\nDETECTION AND PREVENTION OF SQL INJECTION ATTACKS USING A HYBRID TECHNIQUE
\nJalal Omer Atoum and Amer Jibril Qaralleh Princess Sumaya University for Technology, Amman, Jordan
\nABSTRACT
\nSQL injection is a type of attacks used to gain, manipulate, or delete information in any data-driven system whether this system is online or offline and whether this system is a web or non-web-based. It is distinguished by the multiplicity of its performing methods, so defense techniques could not detect or prevent such attacks. The main objective of this paper is to create a reliable and accurate hybrid technique that secure systems from being exploited by SQL injection attacks. This hybrid technique combines static and runtime<\/p>\n","protected":false},"excerpt":{"rendered":"
International Journal of Database Management Systems ( IJDMS ) Vol.6, No.1, February 2014 DOI : 10.5121\/ijdms.2014.6102 21 A HYBRID TECHNIQUE FOR SQL INJECTION ATTACKS DETECTION\u2026<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9033,7586,1386,7589,9034,9031,7587,7588,7584,7585,9032],"tags":[8809,7838,8811,8808,8813,8807,8806,8814,8810,8812],"class_list":["post-106509","post","type-post","status-publish","format-standard","hentry","category-assignment-help-uae","category-best-dissertation-writing-service-in-australia","category-best-research-paper-writing-services-in-usa","category-capstone-project-writing-service","category-cheap-essay-writing-services-china","category-essay-writing-service-usa","category-legitimate-phd-dissertation-writing-services-usa","category-term-paper-writing-service","category-thesis-writing-service-in-canada","category-uae-best-dissertation-writing-help-service","category-write-my-essay-australia","tag-best-master-thesis-writing-service","tag-best-thesis-writing-services","tag-cheap-thesis-writing-services","tag-master-thesis-help","tag-master-thesis-writing-service","tag-thesis-help-online-free","tag-thesis-writing-help-online","tag-thesis-writing-services-cost","tag-thesis-writing-services-near-me","tag-thesis-writing-services-reviews"],"_links":{"self":[{"href":"https:\/\/www.studyproessays.com\/help\/wp-json\/wp\/v2\/posts\/106509","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.studyproessays.com\/help\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.studyproessays.com\/help\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.studyproessays.com\/help\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.studyproessays.com\/help\/wp-json\/wp\/v2\/comments?post=106509"}],"version-history":[{"count":0,"href":"https:\/\/www.studyproessays.com\/help\/wp-json\/wp\/v2\/posts\/106509\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.studyproessays.com\/help\/wp-json\/wp\/v2\/media?parent=106509"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.studyproessays.com\/help\/wp-json\/wp\/v2\/categories?post=106509"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.studyproessays.com\/help\/wp-json\/wp\/v2\/tags?post=106509"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}