Database Injection Detection via Syntactic Pattern Normalization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing techniques for preventing injection attacks on back-end databases are not universally applicable and often result in high false positive rates due to their inability to tailor detection to specific vulnerabilities of individual applications.
Innovation Solution
An injection detector normalizes database statements by replacing query values with placeholder values, identifies potential injection points, and determines if the statement is syntactically correct, thereby reducing false positives by tailoring detection based on application-specific vulnerabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If parameterized statements and database permissions are used to prevent injection attacks, then security is improved, but false positive results increase and applicability is limited to specific application types
Solution Approach 1:
The patent applies local quality by analyzing and detecting injection attacks at specific locations within database statements (injection points) rather than applying universal prevention rules. The system identifies vulnerable points where user input is concatenated into SQL queries and applies detection specifically at those locations, improving precision while maintaining security.
Solution Approach 2:
The system changes parameters by analyzing the syntactic structure of database statements and identifying specific patterns that indicate injection attacks. It transforms the detection approach from generic parameter validation to structure-based analysis, examining the arrangement of SQL commands, clauses, and user input positions to detect malicious patterns.
2Ease of manufacture
If generic injection prevention techniques are applied across different applications, then implementation is simplified, but detection precision decreases due to application-specific vulnerabilities
Solution Approach 1:
The patent segments the database statement analysis into distinct components: identifying user input parameters, locating injection points, analyzing syntactic structure, and detecting attack patterns. This segmentation allows the system to apply precise detection at each stage while maintaining a systematic overall approach that can be implemented across different applications.
Solution Approach 2:
Instead of trying to prevent all possible injection attacks through restrictive measures, the system inverts the approach by analyzing the structure of database statements to identify what constitutes a normal, safe query pattern. It detects attacks by recognizing deviations from these established normal patterns, thereby improving precision without overly complicating implementation.
Data Source
AI summary
Computer systems, devices, and associated methods of detecting and/or preventing injection attacks in databases are disclosed herein. In one embodiment, a method includes determining whether parsing a database statement received from an application on the application server cause a syntax error in a database. In response to determining that parsing the received database statement does not cause a syntax error, determining whether an identical syntactic pattern already exists. In response to determining that an identical syntactic pattern already exists in the database, the method includes indicating that the received database statement does not involve an injection attack.