Database Query Interception and Normalization for Injection Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current learning-based solutions for detecting database injection attacks often produce false positives and negatives, failing to provide full protection, especially during the learning phase and when encountering new or changed features.
Innovation Solution
An enhanced learning-based solution that intercepts and normalizes database queries, compares them with past queries, and stores benign queries in an allowed list to prevent unauthorized execution and detect potential injection threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a learning-based solution is used to detect database injection attacks, then detection capability is improved, but false positives and false negatives increase
Solution Approach 1:
The patent segments the detection process into distinct phases: a learning phase where benign queries are collected and normalized to build a baseline, and an detection phase where incoming queries are compared against this baseline. This segmentation allows the system to improve detection capability while reducing false positives by establishing a clear reference model of normal behavior before attempting to detect anomalies.
Solution Approach 2:
The system performs preliminary action by collecting and normalizing benign database queries during a learning phase before actual detection begins. This preliminary data collection and normalization process creates a baseline of expected query patterns, which significantly reduces false positives and false negatives during subsequent detection operations by providing a reference for comparison.
2Device complexity
If traditional injection detection methods are used, then implementation simplicity is maintained, but protection effectiveness against sophisticated attacks deteriorates
Solution Approach 1:
The patent introduces an intermediary normalization layer between the incoming database queries and the detection logic. This normalization component transforms diverse query formats into a standardized representation, maintaining implementation simplicity by providing a single detection interface while dramatically improving protection effectiveness against sophisticated attacks that rely on format variation and obfuscation techniques.
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
Examples relate to protection against database injection attacks. The examples disclosed herein enable intercepting a current database query prior to being executed by a database management system (DBMS). The examples disclosed herein further enable determining whether the current database query is suspected of having a security threat of a database injection attack by comparing the current database query with past database queries that have been intercepted prior to the interception of the current database query, and in response to determining that the current database query is not suspected of having the security threat of the database injection attack, storing the current database query in an allowed query list.