Welcome to the InfoSci Platform
Reference Hub1
Retrofitting Existing Web Applications with Effective Dynamic Protection Against SQL Injection Attacks

Retrofitting Existing Web Applications with Effective Dynamic Protection Against SQL Injection Attacks

San-Tsai Sun, Konstantin Beznosov
Copyright: © 2010 |Volume: 1 |Issue: 1 |Pages: 21
ISSN: 1947-3036|EISSN: 1947-3044|ISSN: 1947-3036|EISBN13: 9781609600044|EISSN: 1947-3044|DOI: 10.4018/jsse.2010102002
Cite Article Cite Article

MLA

Sun, San-Tsai, and Konstantin Beznosov. "Retrofitting Existing Web Applications with Effective Dynamic Protection Against SQL Injection Attacks." IJSSE vol.1, no.1 2010: pp.20-40. http://doi.org/10.4018/jsse.2010102002

APA

Sun, S. & Beznosov, K. (2010). Retrofitting Existing Web Applications with Effective Dynamic Protection Against SQL Injection Attacks. International Journal of Secure Software Engineering (IJSSE), 1(1), 20-40. http://doi.org/10.4018/jsse.2010102002

Chicago

Sun, San-Tsai, and Konstantin Beznosov. "Retrofitting Existing Web Applications with Effective Dynamic Protection Against SQL Injection Attacks," International Journal of Secure Software Engineering (IJSSE) 1, no.1: 20-40. http://doi.org/10.4018/jsse.2010102002

Export Reference

Mendeley
Favorite Full-Issue Download

Abstract

This article presents an approach for retrofitting existing Web applications with run-time protection against known, as well as unseen, SQL injection attacks (SQLIAs) without the involvement of application developers. The precision of the approach is also enhanced with a method for reducing the rate of false positives in the SQLIA detection logic, via runtime discovery of the developers’ intention for individual SQL statements made by Web applications. The proposed approach is implemented in the form of protection mechanisms for J2EE, ASP.NET, and ASP applications. Named SQLPrevent, these mechanisms intercept HTTP requests and SQL statements, mark and track parameter values originating from HTTP requests, and perform SQLIA detection and prevention on the intercepted SQL statements. The AMNESIA testbed is extended to contain false-positive testing traces, and is used to evaluate SQLPrevent. In our experiments, SQLPrevent produced no false positives or false negatives, and imposed a maximum 3.6% performance overhead with 30 milliseconds response time for the tested applications.

Request Access

You do not own this content. Please login to recommend this title to your institution's librarian or purchase it from the IGI Global bookstore.