SQL Injection Attack Target Estimation via Syntax Tree Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current techniques for detecting SQL injection attacks fail to accurately specify the attack target, even after detection, making it difficult to determine which database or system has been targeted.
Innovation Solution
An estimation system that includes a retrieval unit to identify subtrees matching a query within a syntax tree created from a Web request, and a presentation unit to specify the type of damage and attack target, associated with the retrieved subtree, allowing for precise identification of the attack target.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SQL injection detection techniques (WAF, SVM) are used, then attack detection capability is improved, but attack target specification capability deteriorates
Solution Approach 1:
The patent segments the SQL query into a syntax tree structure, dividing it into multiple nodes representing different components (tables, columns, operators, etc.). This segmentation allows the system to analyze and identify the attack target by examining specific nodes within the tree, thereby resolving the contradiction between detection capability and target specification precision.
Solution Approach 2:
The patent introduces an intermediary estimation apparatus that acts as a bridge between the detection system and the target specification. This apparatus receives the SQL query, creates a syntax tree, and estimates the attack target by analyzing the tree structure, thus enabling precise target identification without compromising detection reliability.
2Adaptability or versatility
If general SQL injection detection methods are applied, then detection coverage is improved, but damage type and target identification capability deteriorates
Solution Approach 1:
The patent applies local quality by assigning specific meanings and properties to different nodes within the syntax tree. Each node represents a specific component of the SQL query with particular characteristics, allowing the system to identify the attack target and damage type by analyzing the local properties of relevant nodes rather than treating the entire query uniformly.
Solution Approach 2:
The patent transforms the one-dimensional SQL query string into a two-dimensional syntax tree structure, adding a hierarchical dimension. This dimensional transformation enables the system to analyze the query from multiple perspectives (structure, semantics, syntax), thereby improving both detection coverage and target identification precision simultaneously.
Data Source
AI summary
An estimation unit retrieves a subtree that matches a query to be estimated, from subtrees included in a syntax tree created from a query inserted into a Web request. In addition, the estimation unit presents information for specifying the type of damage of an attack and an attack target, the information being associated in advance with the subtree obtained by the retrieval of the retrieval unit.