Query Filter List Generation for Injection Attack Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Applications using query languages like SQL remain vulnerable to query language injection attacks due to the complexity of software, despite existing defenses, as they often fail to effectively identify and prevent malicious queries at runtime.
Innovation Solution
A method for generating a query filter list by transforming a set of training queries into a structure that relates predicates and accessed columns, normalizing this structure, and generating a generalized query that is added to the filter list, allowing for the comparison and determination of whether to execute target queries.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If query language injection defenses are implemented, then security against injection attacks is improved, but the complexity of software applications increases
Solution Approach 1:
The system performs preliminary action by transforming and normalizing training queries into a structure before runtime execution. The training queries are pre-processed to create a normalized structure that can be efficiently compared against target queries at runtime, eliminating the need for complex real-time analysis during query execution.
Solution Approach 2:
The system creates a copy of the training queries and transforms them into a normalized structure that serves as a reference model. This copied and transformed structure is then used for comparison against target queries, allowing the system to leverage pre-existing knowledge without adding complexity to the core application logic.
2Measurement precision
If runtime query analysis is performed to detect malicious queries, then detection accuracy is improved, but the time required for query execution increases
Solution Approach 1:
The system performs preliminary transformation and normalization of training queries before runtime. By pre-processing the training data into a normalized structure, the system enables fast comparison against target queries without performing complex analysis during query execution, thus maintaining high detection accuracy while minimizing runtime overhead.
3Adaptability or versatility
If a comprehensive set of training queries is used to generate the filter list, then the coverage of malicious query patterns is improved, but the size of the query filter list increases
Solution Approach 1:
The system merges multiple training queries into a unified normalized structure by grouping entries according to accessed columns. This consolidation process combines the coverage of multiple individual queries into a single compact representation, maintaining comprehensive malicious query pattern coverage while significantly reducing the size of the query filter list.
Solution Approach 2:
The normalized structure serves as a universal representation that can match multiple different malicious query patterns. By creating a generalized structure from training queries, the system achieves multi-functionality where a single entry in the query filter list can detect multiple variants of malicious queries, reducing the overall number of entries needed.
Data Source
AI summary
A method for generating a query filter list includes obtaining set of training queries, each training query comprising a predicate and one or more accessed columns returned from evaluating the predicate, and transforming the set of training queries into a structure. The structure relates, for an accessed column and a training query, the predicate and a correlation value to the accessed column. The method further includes normalizing the structure into a normalized structure. The normalized structure grouping entries in the structure according to accessed column. The method further includes generating a generalized query from the normalized structure, and adding the generalized query to the query filter list.