The IRMA Community
Newsletters
Research IRM
Click a keyword to search titles using our InfoSci-OnDemand powered search:
|
Retrofitting Existing Web Applications with Effective Dynamic Protection Against SQL Injection Attacks
Abstract
This paper presents an approach for retrofitting existing Web applications with run-time protection against known, as well as unseen, SQL injection attacks (SQLIAs) without the involvement of application developers. The precision of the approach is also enhanced with a method for reducing the rate of false positives in the SQLIA detection logic, via runtime discovery of the developers’ intention for individual SQL statements made by Web applications. The proposed approach is implemented in the form of protection mechanisms for J2EE, ASP.NET, and ASP applications. Named SQLPrevent, these mechanisms intercept HTTP requests and SQL statements, mark and track parameter values originating from HTTP requests, and perform SQLIA detection and prevention on the intercepted SQL statements. The AMNESIA testbed is extended to contain false-positive testing traces, and is used to evaluate SQLPrevent. In our experiments, SQLPrevent produced no false positives or false negatives, and imposed a maximum 3.6% performance overhead with 30 milliseconds response time for the tested applications.
Related Content
|
Subrata Tikadar, Kaushik Paul, Abhishek Mukhopadhyay.
© 2026.
26 pages.
|
|
Devanshi Shrivastava, Debanshi Chakraborty, Manjusha Pandey, Siddharth Swarup Rautray.
© 2026.
32 pages.
|
|
Harshita Gupta, Suman Suman Majumder.
© 2026.
12 pages.
|
|
Subhajit Ghosh.
© 2026.
38 pages.
|
|
Sanjib Kundu, Sourav Kayal.
© 2026.
40 pages.
|
|
Sudip Chatterjee, Pronaya Bhattacharya, Subrata Tikadar.
© 2026.
14 pages.
|
|
Chandan Kumar Singh.
© 2026.
40 pages.
|
|
|