Prevention and Detection of SQL Injection Attacks Using Generic Decryption

Abstract

Today, Internet services have become an indispensable part of everyone’s life. With Internet becoming platform to offer services, traditional core services like banking and ecommerce are now being provided in Internet platform, and making security for these services have become necessary. The openness of Internet has increased risk. In certain huge organization’s cyber security, it is usual to notice major issues because of vulnerabilities in their system or software. By performing a depth analysis, it has come to know that the cause of vulnerabilities is either the developers or the design process. Research studies suggest that more than 80% of the active Web sites are vulnerable to SQL injection. The Web sites that unnecessarily expose server information have been recorded as nearly 67%. The Web sites that does not secure session cookies is approximately 50%. About 30% of the Websites secure their communications, for sending sensitive information of users. Hence, a study on mitigation of attacks is compelling. SQL injection targets interactive Internet services that employ database and aims to exploit vulnerability occurring at database layer in the three-tier architecture. This paper proposes a solution to detect and prevent SQL injection attacks using a model which is inspired from the concept of generic decryption. Results obtained confirm the extraordinary performance of the proposed scheme against the existing prevention techniques.