SQL Injection Detection and Prevention Mechanism Coupled with Encryption to Secure Data on E-Commerce Website
Loading...
Files
Date
2018-06-19T10:39:25Z
Authors
Journal Title
Journal ISSN
Volume Title
Publisher
Abstract
SQL injection (SQLi) is an application security weakness that allows attackers to control
an application’s database – letting them access or delete data, change an application’s
data-driven behaviour & other undesirable things. These weaknesses occur when an
application uses untrusted data, such as data entered into web form fields, as part of a
database query. When an application fails to properly sanitize this untrusted data before
adding it to a SQL query, an attacker can include their own SQL commands which the
database will execute.
In this project we develop a SQLi attack detection and prevention system. The proposed
solution is based on SQLi Signature detection and Anomaly detection approaches. The
patterns of SQLi attacks are stored in database. When a web form either through POST or
GET request is received, it is first sent to SQLi signature detection module to match if the
request parameters has any SQL query patterns and if any pattern found, the FORM
request is not processed and user is redirected to Failure response page.
When there is no SQLi pattern , the user behaviour is collected in terms number of times
he requested in a period of time, different source ip address it is requesting web pages and
based on any abnormal behaviour threshold, the user is denied access to web page for
certain duration.
The proposed system of detection and prevention of SQLi is tested against a E-commerce
web application. The E-commerce web application will have Forms for searching
products, prices etc . SQLi attack is launched by typing SQL queries in these Forms and
see the response of the server. The server response with and without proposed SQLi
detection and prevention system will be demonstrated in this project.
The project will be implemented as Web Framework GlassFish web server. The coding
will be done using JAVA. The attack signatures are kept in a file , so new signatures can
be added and the system can be improvised.
The attack signatures are stored in encrypted way(Using AES) , so that it is not possible
for any attacker to modify the attack signatures.
This project will be very useful online shopping and e-commerce websites with Forms.
Leakage of sensitive information in database due to SQL injection attack is prevented by
using the proposed solution.
Description
Keywords
G.GAYATHRI, SUSHMITHA.K, 1NH14CS709, 1NH14CS731