Abstract Syntax Tree Query Injection Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Relational database servers, such as SQL servers, are vulnerable to injection attacks due to the difficulty in defining effective rules for detecting malicious queries, which can lead to unauthorized access and theft of sensitive information.
Innovation Solution
The implementation uses abstract syntax trees to detect malicious queries by generating a tree representation of queries and comparing them against a whitelist, allowing for threshold-based and weighted comparisons, thereby enhancing detection efficiency and reducing false positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional rule-based detection methods are used to identify malicious SQL queries, then detection coverage can be improved, but the complexity of defining and maintaining effective rules increases significantly
Solution Approach 1:
The patent replaces the mechanical rule-based detection system with an abstract syntax tree (AST) based detection system. Instead of manually defining and maintaining complex detection rules, the system parses SQL queries into AST representations and compares them against a whitelist of authorized query patterns. This substitution eliminates the need for complex rule definitions while maintaining detection effectiveness.
Solution Approach 2:
The patent introduces abstract syntax trees as an intermediary representation layer between the raw SQL queries and the detection logic. By transforming queries into AST form, the system creates a standardized intermediate representation that simplifies comparison and pattern matching, eliminating the need for complex rule-based analysis of raw SQL syntax.
2Measurement precision
If multiple detection rules are created to cover subtle query variations, then detection precision can be improved, but the computational load and processing time increase
Solution Approach 1:
The patent changes the parameter representation from raw SQL text to abstract syntax tree structures. This transformation allows for efficient structural comparison of queries with subtle variations by comparing their AST representations rather than their textual forms. The AST representation captures the semantic structure of queries, enabling precise detection of malicious patterns while maintaining efficient processing of legitimate query variations.
3Reliability
If strict rule-based filtering is applied to block suspicious queries, then security reliability can be improved, but the number of false positives increases
Solution Approach 1:
The patent implements a whitelist-based detection system that performs preliminary identification of authorized query patterns. By pre-defining what legitimate queries look like in AST form, the system can efficiently determine whether a query is malicious by checking if its AST representation matches any whitelisted patterns. This approach reduces false positives by focusing on positive identification of legitimate queries rather than attempting to block all suspicious patterns.
Data Source
AI summary
A device may include one or more memories; and one or more processors, communicatively coupled to the one or more memories, to receive a query for data stored by a database; generate an abstract syntax tree based on the query; determine whether the abstract syntax tree matches a list, where the list identifies one or more abstract syntax trees corresponding to queries or types of queries; and selectively perform an action based on whether the abstract syntax tree matches the entry of the list.