SQL Injection Detection via Behavioral Biometrics
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cybersecurity solutions are inadequate in detecting SQL injection attacks in real-time due to their inability to examine computer applications at a low enough granularity and maintain state, leading to delayed or missed detection of malware attacks, as they rely on observing network behavior or sandboxing suspicious code, which can adapt to evade detection.
Innovation Solution
The system captures and analyzes web requests and database queries in real-time, comparing them against a valid database query table to detect unauthorized queries, using an analysis engine and instrumentation engine to correlate user, session, and context information, and perform remediation actions automatically.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If current cybersecurity solutions observe network behavior or sandbox suspicious code, then detection capability is provided, but detection timing is delayed and malware can adapt to evade detection
Solution Approach 1:
The system performs preliminary action by establishing a baseline model of normal application behavior before attacks occur. The behavioral biometrics engine continuously learns and establishes what constitutes normal application operations, enabling the system to detect deviations immediately when they occur, rather than waiting for malware to execute or network behavior to manifest
Solution Approach 2:
The patent replaces traditional mechanical detection systems (network traffic analysis, sandboxing) with a behavioral biometrics-based detection mechanism. Instead of observing external network behavior or executing code in sandboxes, the system directly monitors application behavior patterns at the binary level, substituting physical/network-layer detection with application-layer behavioral analysis
2Reliability
If cybersecurity products deploy next generation firewalls or web application firewalls, then attempt to tie user access to markers, but malware adapts behavior to evade detection
Solution Approach 1:
The system implements continuous feedback by constantly monitoring application behavior and comparing it against the established baseline. The behavioral biometrics engine provides real-time feedback on deviations from normal behavior, enabling dynamic detection that adapts to new threats without requiring malware to be caught off guard. This creates a closed-loop system where detection continuously improves
Solution Approach 2:
The patent changes the detection parameter from network-level markers or sandbox execution outcomes to application behavior parameters. By monitoring behavioral biometrics such as function call patterns, data access sequences, and operational timing at the application binary interface level, the system detects attacks based on behavioral changes rather than static markers that malware can easily bypass
3Measurement precision
If systems examine computer applications at low granularity in process memory, then reliably detect root cause triggers, but current technologies lack the capability to maintain state over extended periods
Solution Approach 1:
The system achieves universality by creating a detection framework that simultaneously provides high-granularity behavioral analysis and long-term state maintenance through a single integrated behavioral biometrics engine. The baseline model serves multiple functions: it enables precise detection of individual events while also maintaining contextual understanding across extended time periods, eliminating the need for separate mechanisms for each capability
Data Source
Figure 1
Figure 2
Figure 3A
AI summary
In an example embodiment, a system detects unauthorized database queries made by a maliciously formed web request. The system captures a web request for a web application and one or more database queries triggered in response to the web request during runtime. If the captured web request matches a valid web request in a table of valid web requests for the web application, the system checks if each captured database query matches a valid database query mapped to the valid web request in the table. The system may declare an injection attack if at least one captured database query does not match a valid database query mapped to the valid web request, or may perform additional validation of the captured request and the at least one captured database query prior to declaring the attack. The system may form the table of valid web requests using a dynamic simulation process, using static code analysis, or a combination of both.