SQL injection attacks detection in adversarial environments by k-centers

Abstract

SQL injection is one of common vulnerabilities in web applications. In SQL injection vulnerability, the database server is forced to execute malicious operations which may cause the data loss or corruption, denial of access, and unauthentic access to sensitive data by crafting specific inputs. Most of existing methods are based on encryption, syntax parse trees or semantic equivalence of the SQL statements. As no learning and adaption capabilities in these methods, they are not suitable for adversarial environments. A new method named k-centers (KC) is proposed to detect SQL injection attacks (SQLIAs) in this paper. The number and the centers of the clusters in KC are adjusted according to unseen SQL statements in the adversarial environment, in which the types of attacks are changed after a period of time, to adapt different kinds of attacks. The emperimental results show that the proposed method has a satisfying result on the SQLIAs detection in the adversarial environment.