NDLI: CANDID: Dynamic candidate evaluations for automatic prevention of SQL injection attacks

Please wait, while we are loading the content...

ACM Transactions on Information and System Security (TISSEC) : Volume 18

ACM Transactions on Information and System Security (TISSEC) : Volume 17

ACM Transactions on Information and System Security (TISSEC) : Volume 16

ACM Transactions on Information and System Security (TISSEC) : Volume 15

ACM Transactions on Information and System Security (TISSEC) : Volume 14

ACM Transactions on Information and System Security (TISSEC) : Volume 13

Issue 4, December 2010

Issue 3, July 2010

Issue 2, February 2010

Guest editorial: Special issue on computer and communications security

Stealthy malware detection and monitoring through VMM-based “out-of-the-box” semantic view reconstruction

How much anonymity does network latency leak?

CANDID: Dynamic candidate evaluations for automatic prevention of SQL injection attacks

New payload attribution methods for network forensic investigations

Split-ballot voting: Everlasting privacy with distributed trust

Authenticated error-correcting codes with applications to multicast authentication

Deterring voluntary trace disclosure in re-encryption mix-networks

Issue 1, October 2009

ACM Transactions on Information and System Security (TISSEC) : Volume 12

ACM Transactions on Information and System Security (TISSEC) : Volume 11

ACM Transactions on Information and System Security (TISSEC) : Volume 10

ACM Transactions on Information and System Security (TISSEC) : Volume 9

ACM Transactions on Information and System Security (TISSEC) : Volume 8

ACM Transactions on Information and System Security (TISSEC) : Volume 7

ACM Transactions on Information and System Security (TISSEC) : Volume 6

ACM Transactions on Information and System Security (TISSEC) : Volume 5

ACM Transactions on Information and System Security (TISSEC) : Volume 4

ACM Transactions on Information and System Security (TISSEC) : Volume 3

ACM Transactions on Information and System Security (TISSEC) : Volume 2

ACM Transactions on Information and System Security (TISSEC) : Volume 1

CANDID: Dynamic candidate evaluations for automatic prevention of SQL injection attacks

Content Provider	ACM Digital Library
Author	Bisht, Prithvi Venkatakrishnan, V. N. Madhusudan, P.
Copyright Year	2010
Abstract	SQL injection attacks are one of the top-most threats for applications written for the Web. These attacks are launched through specially crafted user inputs, on Web applications that use low-level string operations to construct SQL queries. In this work, we exhibit a novel and powerful scheme for automatically transforming Web applications to render them safe against all SQL injection attacks. A characteristic diagnostic feature of SQL injection attacks is that they change the intended structure of queries issued. Our technique for detecting SQL injection is to dynamically mine the programmer-intended query structure on any input, and detect attacks by comparing it against the structure of the actual query issued. We propose a simple and novel mechanism, called Candid, for mining programmer intended queries by dynamically evaluating runs over benign candidate inputs. This mechanism is theoretically well founded and is based on inferring intended queries by considering the symbolic query computed on a program run. Our approach has been implemented in a tool called Candid that retrofits Web applications written in Java to defend them against SQL injection attacks. We have also implemented Candid by modifying a Java Virtual Machine, which safeguards applications without requiring retrofitting. We report extensive experimental results that show that our approach performs remarkably well in practice.
Starting Page	1
Ending Page	39
Page Count	39
File Format	PDF
ISSN	10949224
e-ISSN	15577406
DOI	10.1145/1698750.1698754
Volume Number	13
Issue Number	2
Journal	ACM Transactions on Information and System Security (TISSEC)
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2010-03-05
Publisher Place	New York
Access Restriction	One Nation One Subscription (ONOS)
Subject Keyword	SQL injection attacks Dynamic monitoring Retrofitting code Symbolic evaluation
Content Type	Text
Resource Type	Article
Subject	Computer Science Safety, Risk, Reliability and Quality

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

CANDID: preventing sql injection attacks using dynamic candidate evaluations

CANDID: Dynamic Candidate Evaluations for Automatic Prevention of SQL Injection Attacks

CPM: Masking Code Pointers to Prevent Code Injection Attacks

SECSIX: security engine for CSRF, SQL injection and XSS attacks

Off-Path TCP Injection Attacks

Picture Gesture Authentication: Empirical Analysis, Automated Attacks, and Scheme Evaluation

False data injection attacks against state estimation in electric power grids

A survey on SQL injection attacks, detection and prevention techniques

Monitoring Translation Lookahead Buffers to Detect Code Injection Attacks

CANDID: Dynamic candidate evaluations for automatic prevention of SQL injection attacks

Similar Documents

CANDID: preventing sql injection attacks using dynamic candidate evaluations

CANDID: Dynamic Candidate Evaluations for Automatic Prevention of SQL Injection Attacks

CPM: Masking Code Pointers to Prevent Code Injection Attacks

SECSIX: security engine for CSRF, SQL injection and XSS attacks

Off-Path TCP Injection Attacks

Picture Gesture Authentication: Empirical Analysis, Automated Attacks, and Scheme Evaluation

False data injection attacks against state estimation in electric power grids

A survey on SQL injection attacks, detection and prevention techniques

Monitoring Translation Lookahead Buffers to Detect Code Injection Attacks

CANDID: Dynamic candidate evaluations for automatic prevention of SQL injection attacks