Evaluation of anomaly based character distribution models in the detection of SQL injection attacks

ARES 2008 - 3rd International Conference on Availability, Security, and Reliability, Proceedings

Volumn , Issue , 2008, Pages 47-55

  Kiani, Mehdi ^a   Clark, Andrew ^a   Mohay, George ^a  

^a QUEENSLAND UNIVERSITY OF TECHNOLOGY   (Australia)

Author keywords

[No Author keywords available]

Indexed keywords

DATABASE SYSTEMS; HTTP; WORLD WIDE WEB;

APPLICATIONS.; CONFIDENTIAL INFORMATION; DISTRIBUTION MODELS; INTERNATIONAL CONFERENCES; SOURCE CODING; SQL-INJECTION; USER INTERACTIONS; WEB APPLICATIONS;

COMPUTER CRIME;

EID: 49049112901     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ARES.2008.123     Document Type: Conference Paper

References (19)

1. W. Halfond and A. Orso, "Combining Static Analysis and Runtime Monitoring to Counter SQL-Injection Attacks," Proceeding of the Third International ICSE Workshop on Dynamic Analysis (WODA 2005), 2005.
2. OWASP, "Category: OWASP Top Ten Project," vol. 2007, 2007.
3. C. Anley, "Advanced SQL Injection In SQL Server Applications," vol. 2005, 2002.
4. C. Krügel, T. Toth, and E. Kirda, "Service specific anomaly detection for network intrusion detection," 2002.
5. C. Kruegel and G. Vigna, "Anomaly detection of web-based attacks," presented at Proceedings of the 10th ACM conference on Computer and communication security, 2003.
6. K. Wang and S. Stolfo, "Anomalous Payload-based Network Intrusion Detection," Proceedings of the Seventh International Symposium on Recent Advance in Intrusion Detection (RAID), Sept, 2004.
7. F. Valeur, D. Mutz, and G. Vigna, "A Learning-Based Approach to the Detection of SQL Attacks," presented at Proc. of the Conference on Detection of Intrusions and Malware and Vulnerability Assessment (DIMVA), Vienna, Austria, Jul, 2005.
8. A. Singhal and S. Jajodia, "Data warehousing and data mining techniques for intrusion detection systems," Distributed and Parallel Databases, vol. 20, pp. 149-166, 2006.
9. H. Debar, M. Dacier, and A. Wespi, "Towards a taxonomy of intrusion-detection systems," presented at Computer Networks, 1999.
10. D. Scott and R. Sharp, "Abstracting application-level web security," Proceedings of the 11th international conference on World Wide Web, pp. 396-407, 2002.
11. M. Kiani, A. Clark, and G. Mohay, "Length Based Modelling of HTTP Traffic for Detecting SQL Injection Attacks," presented at In Proceedings of 2007 RNSA Security Technology Conference, Melbourne, Australia, 2007.
12. C. Anley, "Advanced SQL Injection In SQL Server Applications," 2002.
13. K. Spett, "White Paper, SPI Dynammics," vol. 2005, 2002.
14. O. Maor and A. Shulman, "SQL Injection Signatures Evasion," 2004.
15. W. Halfond, J. Viegas, and A. Orso, "A Classification of SQL-Injection Attacks and Countermeasures," Proc. of the Intl. Symposium on Secure Software Engineering, Mar, 2006.
16. J. McHugh, "Testing intrusion detection systems: A critique of the 1998 and 1999 darpa off-line intrusion detection system evaluation as performed by lincoln laboratory," ACM Transactions on Information and System Security, vol. 3, 2000.
17. G. Buehrer, B. Weide, and P. Sivilotti, "Using parse tree validation to prevent SQL injection attacks," presented at Proceedings of the 5th international workshop on Software engineering and middleware, 2005.
18. M. Mamahlodi, "What is the chi-square statistic?," vol. 2007, 2006.
19. B. Weaver, "Assumptions/restrictions for use of chi-square tests," vol. 2007, 2006.