Ejemplo de Aplicación

Figure 3-4 presents this section organisation chart with the associated subsections.

Figure 3-4 Dynamic runtime analysis techniques category chart: The figure shows this section organisation chart with the related subsections.

There are several existing techniques proposed by researchers under dynamic runtime analysis, which are to be discussed below. The dynamic runtime analysis is usually preceded in most approaches by statically generating all possible valid queries to a web application and matching the web requests at runtime against these valid queries to detect an anomaly or SQLIA. Also, included is the tainting techniques which involve the labelling of data which is then tracked to the sink (database entry). In the context of emerging computing and big data mining for SQLIA, we also discuss existing ML techniques including the technique proposed in this thesis to predict and prevent SQLIA.

3.4.1 Runtime analysis

Boyd & Keromytis [84] proposed SQLrand that employs proxy and parser whereby a query is randomised and de-randomised at the proxy on the assumption that an attacker will create invalid queries to cause runtime errors which will identify the SQLIA. The solutions were designed to fit into both new systems and can also be retrofitted into an existing web application for deployment. The authors claimed the methodology to have a negligible impact on performance; but, it is unlikely that it would be scalable in today’s

Dynamic runtime analysis

43

large data-driven web applications. Also, the process of randomisation was simplistic as the string appended to the SQL keywords could easily be replicated by an attacker.

Valeur et al. [121] proposed anomaly based system approach that learns and score profiles of the standard database access performed by web-based applications. The web requests or dynamic queries are intercepted where input vectors are inserted into tokens marked as a constant and compared by using statistical scoring methods. The learning phases are sectioned into two halves. The scores of the second half are then calculated with values exceeding the threshold set in the first half deemed anomalous. The authors evaluated the approach to have a high degree of success in the detection of SQLIA. However, the limitation is that it requires extensive training for excellent detection capabilities [82].

Buehrer et al. [4] proposed a SQL parsing tree which uses a combination of proxy and SQL parse tree for a genetic algorithm SQL syntax sequence alignment for detection of SQLIV. Though this approach applies gene sequencing alignment techniques, it has a similarity with valid queries matching techniques to establish SQLIA detection.

Halfond & Orso [5] proposed AMNESIA, a hybrid of static and dynamic approach that employed pattern matching between valid requests against dynamic web requests at runtime to detect and prevent SQLIA. Although the approach scaled well in traditional string matching at the time, it is unlikely that the method could meet the demand of emerging computing in big data scenarios that would require predictive analytics techniques for big data mining.

Wei et al. [123] proposed matching a static valid web application’s SQL query against a dynamic analysis of queries at runtime to detect and prevent stored procedures SQLIA type. The drawback to this approach is that it is limited to only stored procedure detection SQLIA type and does not cover the other SQLIA types as discussed in Chapter 2. To address this limitation, Karuparthi & Zhou [91] presented an enhanced version of a dynamic query matching method [121], [122] to detect other SQLIA types. However, the enhanced model is a traditional string lookup technique which will not be functional in internet big data analysis.

Bisht et al. [11] proposed an approach named CANdidate evaluation for Discovery Intent Dynamically (CANDID). The approach was centred on the Java-based web application code analysis by mining programmer intended query structure of any input and comparing it against the structure of the actual query as to detect and prevent SQLIA. The benefit claimed by the authors of the approach is that it can be retrofitted, but the

44

bytecode transformation could be computationally expensive to scale well in big internet data-driven traffic. Also, there are restrictions to source code access in the cloud-hosted applications to generate bytecode.

Fu and Li [125] proposed a string constant solver algorithm named SUSHI employing an automata-based approach to solve a simple linear string equation for attack signatures and error traces thereby exposing SQLIA and Cross Scripting (XSS) vulnerabilities. The approach reduces false positives in string analysis techniques, but it is computationally expensive to scale well in current big data-driven web applications.

Fernando and Abawajy [119] applied both static and dynamic approaches for detecting and preventing SQLIA in Radio-frequency identification (RFID). The drawback to this method is that it is not web-agnostic, which most modern RFIDs support. Shahriar and Zulkernine [14] proposed an information theory based detection framework for SQLIV prediction. The approach applies static and dynamic script analysis of the query to calculate the entropy to detect malicious queries. The approach is not robust to dynamically detect all SQL types like stored procedure attack.

Jang & Choi [122] presented an approach for detecting SQL injection attacks using query result size. The approach employs a technique that dynamically analyses the developer intended query result size of the given input and then detects attacks by comparing this against the product of the actual query. The implementation includes running input against two layers: substitution variable verification and Query Cost Estimator (QCE). The replacement variable verification checks the attack patterns and vulnerabilities in the SQL queries. The QCE computes the predicates in SQL queries and estimates the table and column cardinalities in addition to estimating and comparing query result sizes. The drawback of this approach is a limitation in complex relationship queries that use an inner join which compares the result size, meaning that it will yield high false positive rates.

Kar et al. [120] proposed SQLiDDS; an approach that consists of offline and runtime. During the offline, the tail-end (after WHERE clause) of suspected queries are extracted and transformed to compute MD5 hash value stored in a reference hash table which uses hierarchical agglomerative clustering employing the averaging link method to aggregate related queries into a single document of highly related clusters. The transformation scheme where the comparison between static and dynamic query is computed by counting words could yield a false result as there are possibilities to arrive at the same number of words in the computation schemes.

45 3.4.2 Taint-based

Wassermann and SU [126] proposed a static algorithm for string analysis to find SQLIV. The algorithm statically generates a set of possible database queries that a web application may generate by employing context-free grammars which are then tracked by information flow from untrusted sources to these queries to detect vulnerabilities. It is a taint technique of tracking data flow from untrusted sources, but its drawback is the high false positive rates [82].

Halfond et al. developed a tool named Web application SQL Injection Preventer (WASP) [7] that is an attack runtime prevention method employing positive tainting of tracking trusted data as against traditionally negative tainting of tracking untrusted data. Though taint approaches with trusted data are fraught with the risk of increased false positive, the author deemed the proposal more plausible than related approaches which saw high false negative rates of tracking a taint data with untrusted data source employed in these cited papers [165], [174]. The WASP improvement in syntax-aware evaluation used a database parser to interpret the query before it is executed and provided a flexible mechanism that allows different trust policies to be associated with various input sources. Kie et al. [127] developed a tool named ARDILLA for SQLI and XSS vulnerabilities detection through a technique of input generation, dynamic taint propagation and input mutation to detect vulnerabilities. ARDILLA automates the creation of test inputs to reveal SQLI and XSS by employing tainting techniques; the test input is symbolically tracked as it executes to mutate the inputs to produce vulnerabilities. The tool had few false positive rates, and addressed second-order vulnerability as claimed by the authors, but a taint technique that employs tracking of data from untrusted sources to detect vulnerabilities are known for high false positive rates. A further drawback to the use of this approach in modern web applications is that the flow of data to applications is so diverse that there can be no guarantee of receiving data from only trusted sources.

The section below discusses ML approaches to SQLIA detection and prevention, which is also the subject of the thesis presented in this thesis. After a careful study of the literature reviewed in the sections above, we deemed ML is a plausible approach to mitigate SQLIA in emerging computing.

3.4.3 Machine Learning and Neural Network runtime analysis

This method applies artificial intelligence which requires a robust data set with different patterns in data items to train a classifier. Applying ML requires robust data set items

46

with patterns to train a classifier implementing AI algorithms to predict SQLI accurately. Unfortunately, as there is no single standardised data set that can be used in training an AI model for all scenarios of web application vulnerabilities, researchers have presented various approaches for extracting data sets with most proposals suffering from limited data engineering (data set with patterns to enhanced ML prediction). The HTTP dataset CSIC 2010 [66] does not present a robust, versatile pattern-driven data set as it was a purpose-built data set following a classic data set extraction using automated tools to log web requests with repeating query strings and occasional variation in query strings. These data sets are repeatedly found in research work as test data for evaluations and have come under scrutiny over the years of being dated and irrelevant to building a real business application.

There have been various ML algorithm proposals by researchers over the years to mitigate web applications SQLIA vulnerabilities. We reviewed literature on the popular ML algorithms to detect and prevent SQLIA which are: [71], [72], [74], [128]–[133], [100], [134]–[136],[137]–[141] to observe drawbacks in the data set devoid of patterns as they share a commonality in reliance on URL query strings, SQL internal query structure and static generated data set which is often repeated strings. We selected for further discussion some of these approaches employing SVM, LR and NN algorithms in subsequent paragraphs.

Bockermann et al. [75] proposed the tree kernels for analysing SQL statement in addition to exploring feature vectorisation of data input to an SVM classifier, but found there to be drawbacks in the tree-kernels computational overhead. Also, their data set extraction was dependent on URL strings which are repeating strings that are lacking in patterns.

Choi et al. [72] train an SVM classifier using feature vectorisation by N-Grams employing bigrams, trigrams and 4-grams for queries comparison. Their approach would need various patterns to improve the accuracy of the approach as the data set used has few distributions in the training data set of 608 attribute values (normal and malicious) and 306 attribute values of test data. Also, the approach requires access to full source code.

Kar et al. [137] proposed using a SQL query of normalised query elements to tokens to build a graph of tokens and centrality of nodes to train an SVM classifier, though an ML approach it mirrors a classical queries comparison between a normalised tokenised and runtime query to detect SQLI at database firewall. The approach looks promising in

47

an intranet and extranet but not applicable to cloud-hosted web applications SDN endpoints. As the SQLIA mitigation is at the database level, the injected queries if not intercepted by other SQLIA protection during the transition are left to bypass firewall before be enumerated for tokens used in the ML query comparison approach. Also, this enumeration or tokenisation of schema changes takes 30 minutes, which will not scale in big data web traffic analysis.

Wang and Li [73] proposed an SQL query program tracing in which related queries are grouped based on the runtime program trace. However, the approach’s drawback is the reliance on the source code for the SQL tracing grouping that is hashed to the vector matrices for a classifier implementing the SVM algorithm.

Pinzón et al. [74] present a multi-agent approach that uses various classifiers including SVM and neural networks to predict SQLIA from SQL queries behaviour that is stored as cases. Though an ML approach, it mirrors a classical queries comparison. The architecture named CBR cycle is computationally expensive and needs access to source code.

Kim and Lee [138] proposed an approach that uses the SVM classifier for binary classification of internal query representation known as query trees. The training data comprised of feature vectors from transformed query trees of the internal query structure. Its drawback is that it requires access to the source code and is computationally complex because of the size of the query trees.

We reviewed existing literature on SQLI to establish the research gap and defined a research goal to present in this thesis a supervised learning model that uses a data set input from patterns of both expected data and SQLIA types including SQL tokens to train classifiers. We started with an investigation of numerically encoding of both valid data input and patterns of SQLIA types including SQL tokens to test the performance metrics of vector matrices of data set input derived from patterns [61], [62]. We further our approach by applying ML predictive analytics to SQLIA prediction and prevention [63], [64]. The approach presented in this thesis relies on the web requests or data input at runtime to detect SQLIA as against raw queries comparison as proposed in most runtime analysis.