NDLI: Obfuscation-based analysis of SQL injection attacks

Content Provider	IEEE Xplore Digital Library
Author	Halder, R. Cortesi, A.
Copyright Year	2010
Description	Author affiliation: Dipartimento di Informatica, Università Cá Foscari di Venezia, Italy (Halder, R.; Cortesi, A.)
Abstract	In this paper, we propose an obfuscation/ deobfuscation based technique to detect the presence of possible SQL Injection Attacks (SQLIA) in a query before submitting it to a DBMS. This technique combines static and dynamic analysis. In the static phase, the queries in the application are replaced by queries in obfuscated form. The main idea behind obfuscation is to isolate all the atomic formulas from other control elements of the query. During the dynamic phase, the user inputs are merged into the obfuscated atomic formulas, and the dynamic verifier analysis the presence of possible SQLIA at atomic formula level. Finally, a deobfuscation step is performed to recover the original query before submitting it to the DBMS.
Starting Page	931
Ending Page	938
File Size	234289
Page Count	8
File Format	PDF
ISBN	9781424477548
ISSN	15301346
e-ISBN	9781424477555
DOI	10.1109/ISCC.2010.5546750
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2010-06-22
Publisher Place	Italy
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Databases Encoding Security Pediatrics Logic gates Servers Feature extraction Deobfuscation SQL Injection Attack Obfuscation
Content Type	Text
Resource Type	Article
Subject	Signal Processing Mathematics Computer Networks and Communications Computer Science Applications Software

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Obfuscation-based analysis of sql injection attacks (2010)

A fast and secure way to prevent SQL injection attacks

A Taxonomy of SQL Injection Attacks

Augmented attack tree modeling of SQL injection attacks

Automatic classification of cross-site scripting in web pages using document-based and URL-based features

Mitigating SQL Injection Attacks via Hybrid Threat Modelling

Security Standards Perspective to Fortify Web Database Applications from Code Injection Attacks

SQL Injection Attack classification through the feature extraction of SQL query strings using a Gap-Weighted String Subsequence Kernel

A Framework for Measuring Software Obfuscation Resilience against Automated Attacks

Obfuscation-based analysis of SQL injection attacks

Similar Documents

Obfuscation-based analysis of sql injection attacks (2010)

A fast and secure way to prevent SQL injection attacks

A Taxonomy of SQL Injection Attacks

Augmented attack tree modeling of SQL injection attacks

Automatic classification of cross-site scripting in web pages using document-based and URL-based features

Mitigating SQL Injection Attacks via Hybrid Threat Modelling

Security Standards Perspective to Fortify Web Database Applications from Code Injection Attacks

SQL Injection Attack classification through the feature extraction of SQL query strings using a Gap-Weighted String Subsequence Kernel

A Framework for Measuring Software Obfuscation Resilience against Automated Attacks

Obfuscation-based analysis of SQL injection attacks