Security in web applications: a comparative analysis of key SQL injection detection techniques

Veerabudren, Karel Ronan and Bekaroo, Girish ORCID: https://orcid.org/0000-0003-1753-4300 (2022) Security in web applications: a comparative analysis of key SQL injection detection techniques. 2022 4th International Conference on Emerging Trends in Electrical, Electronic and Communications Engineering (ELECOM). In: 4th International Conference on Emerging Trends in Electrical, Electronic and Communications Engineering (ELECOM), 22-24 Nov 2022, Mauritius. e-ISBN 9781665466974, e-ISBN 9781665466967, pbk-ISBN 9781665466981. [Conference or Workshop Item] (doi:10.1109/elecom54934.2022.9965264)

Preview

PDF - Final accepted version (with author's formatting) Download (279kB) | Preview

Abstract

Over the years, technological advances have driven massive proliferation of web systems and businesses have harbored a seemingly insatiable need for Internet systems and services. Whilst data is considered as a key asset to businesses and that their security is of extreme importance, there has been growing cybersecurity threats faced by web systems. One of the key attacks that web applications are vulnerable to is SQL injection (SQLi) attacks and successful attacks can reveal sensitive information to attackers or even deface web systems. As part of SQLi defence strategy, effective detection of SQLi attacks is important. Even though different techniques have been devised over the years to detect SQLi attacks, limited work has been undertaken to review and compare the effectiveness of these detection techniques. As such, in order to address this gap in literature, this paper performs a review and comparative analysis of the different SQLi detection techniques, with the aim to detect SQLi attacks in an effective manner and enhance the security of web applications. As part of the investigation, seven SQLi detection techniques including machine learning based detection are reviewed and their effectiveness against different types of SQLi attacks are compared. Results identified positive tainting and adoption of machine learning among the most effective techniques and stored procedures based SQLi as the most challenging attack to detect.

Actions (login required)

View Item

Statistics

DownloadsShow export options

Export as CSVXMLJSON

Activity Overview

6 month trend

20Downloads

6 month trend

28Hits

Additional statistics are available via IRStats2.