Reference : Behind an Application Firewall, Are We Safe from SQL Injection Attacks?
Scientific congresses, symposiums and conference proceedings : Paper published in a book
Engineering, computing & technology : Computer science
http://hdl.handle.net/10993/19703
Behind an Application Firewall, Are We Safe from SQL Injection Attacks?
English
Appelt, Dennis mailto [University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) > >]
Nguyen, Duy Cu mailto [University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) > >]
Briand, Lionel mailto [University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) > > ; University of Luxembourg > Faculty of Science, Technology and Communication (FSTC) > Computer Science and Communications Research Unit (CSC)]
2015
2015 IEEE 8th International Conference on Software Testing, Verification, and Validation (ICST)
Yes
International
978-1-4799-7124-4
8th International Conference on Software Testing, Verification, and Validation
13-17 April 2015
[en] Security Testing ; SQL Injection ; Machine Learning
[en] Web application firewalls are an indispensable layer to protect online systems from attacks. However, the fast pace at which new kinds of attacks appear and their sophistication require that firewalls be updated and tested regularly as otherwise they will be circumvented. In this paper, we focus our research on web application firewalls and SQL injection attacks. We present a machine learning-based testing approach to detect holes in firewalls that let SQL injection attacks bypass. At the beginning, the approach can automatically generate diverse attack payloads, which can be seeded into inputs of web-based applications, and then submit them to a system that is protected by a firewall. Incrementally learning from the tests that are blocked or passed by the firewall, our approach can then select tests that exhibit characteristics associated with bypassing the firewall and mutate them to efficiently generate new bypassing attacks. In the race against cyber attacks, time is vital. Being able to learn and anticipate more attacks that can circumvent a firewall in a timely manner is very important in order to quickly fix or fine-tune the firewall. We developed a tool that implements the approach and evaluated it on ModSecurity, a widely used application firewall. The results we obtained suggest a good performance and efficiency in detecting holes in the firewall that could let SQLi attacks go undetected.
Interdisciplinary Centre for Security, Reliability and Trust ; University of Luxembourg: High Performance Computing - ULHPC
Fonds National de la Recherche - FnR
Researchers ; Professionals ; Students
http://hdl.handle.net/10993/19703
10.1109/ICST.2015.7102581

File(s) associated to this reference

Fulltext file(s):

FileCommentaryVersionSizeAccess
Limited access
main.pdfAuthor preprint634.01 kBRequest a copy

Bookmark and Share SFX Query

All documents in ORBilu are protected by a user license.