Sciweavers

Share
IJSSE
2010

Retrofitting Existing Web Applications with Effective Dynamic Protection Against SQL Injection Attacks

10 years 10 months ago
Retrofitting Existing Web Applications with Effective Dynamic Protection Against SQL Injection Attacks
This paper presents an approach for retrofitting existing web applications with runtime protection against known as well as unseen SQL injection attacks (SQLIAs) without the involvement of application developers. The precision of the approach is also enhanced with a method for reducing the rate of false positives in the SQLIA detection logic, via runtime discovery of the developers' intention for individual SQL statements made by web applications. The proposed approach is implemented in the form of protection mechanisms for J2EE, ASP.NET, and ASP applications. Named SQLPrevent, these mechanisms intercept both HTTP requests and SQL statements, mark and track parameter values originating from HTTP requests, and perform SQLIA detection and prevention on the intercepted SQL statements. The AMNESIA testbed is extended to contain false-positive testing traces, and is used to evaluate SQLPrevent. In our experiments, SQLPrevent produced no false positives or false negatives, and imposed ...
San-Tsai Sun, Konstantin Beznosov
Added 05 Mar 2011
Updated 05 Mar 2011
Type Journal
Year 2010
Where IJSSE
Authors San-Tsai Sun, Konstantin Beznosov
Comments (0)
books