SQL injection attack slide for presentation in december 2024

1. SQL Attribute value
SQL Attribute Value
The presence of harmful attribute values within SQL queries poses a
serious risk to web application security, especially in the context of SQL
Injection (SQLi) attacks
 Attackers can exploit these values to inject complex, resource-intensive
commands into the database, potentially overwhelming the system and leading to
performance degradation, slow responses, or even denial of service.
 Eliminating these unnecessary and potentially dangerous attribute values from
SQL queries before processing is a proactive measure that strengthens system
defences. (Nair, 2024).
 The key challenge occurs because of duplicate substrings in the form
of SQL attribute values in query strings. (Sun et al. 2023)
 It enables optimization and security by preventing unauthorized
access, reducing system load, reducing system load, and reducing the
chances of exploitation due to malformed or malicious inputs

2. SQL Attribute value
 They are values typically originating from user inputs but not part of
the primary syntactic form that introduce variability in the character
set of the query.
 Due to the sensitivity of LSTM networks to sequence and character
diversity, an irregular and too large character space can lead to
increased computation requirements and even overfitting on non-
contributory unrelated patterns that do not help detect injections.
 By sanitizing input and removing elements that do not contribute to
the functional structure of the SQL query, developers can significantly
reduce the attack surface for SQL injection and related threats.
 Table 1 Model Comparison
Model Accuracy Precision Recall F1=Score
CNN+BILSTM 99.71 99.71 99.71 99.71

3. SQL Attribute value
Authors Journal name
Katole, et al.
2018,
Detection of SQL injection attacks by removing the parameter values of the SQL que
ry
Kamaruzman
et al 2021.
Fixed Attribute Value Removal Method and Anomaly-Based Profiled Method, An SQ
Li Detection Effectiveness Study
McWhirter et
al, 2018
SQL Injection Attack classification through the feature extraction of SQL query strings using a
Gap-Weighted String Subsequence Kernel

4. SQL Attack Prevention
SQL injection attacks remain one of the most pervasive and damaging threats to the
security and integrity of web applications and databases. thereby preventing the
manipulation of SQL queries by malicious input.
Prepared statements are widely regarded as one of the most effective methods for
mitigating SQL injection attacks. By separating SQL query structures from user input,
prepared statements ensure that user data is treated strictly as data and not executable
code, thereby preventing the manipulation of SQL queries by malicious input. )
. This means that user input is bound to placeholders in the SQL statement, and the
database knows that these placeholders are not part of the actual query.
many developers do not implement prepared statements across all parts
of an application, which leaves gaps in the security of the application.

5. SQL Attack Prevention
Furthermore, developers who are unfamiliar with how to implement
prepared statements correctly or who overlook edge cases may
inadvertently leave their applications open to exploitation.
Inconsistent usage of prepared statements is a common issue; parts of the
application may use traditional methods of dynamically building queries,
thus exposing those sections to SQL injection vulnerabilities.
Therefore, the problem lies not only in promoting the adoption of prepared statements
but also in ensuring they are properly and uniformly applied across the entire
application, leaving no room for SQL injection attacks to succeed.
Using Prepared Statement in MySQL (example)
PREPARE stmt FROM 'SELECT * FROM users WHERE username = ? AND password = ?';
SET @username = 'user_input';
SET @password = 'password_input';
EXECUTE stmt USING @username, @password;
DEALLOCATE PREPARE stmt;

6. SQL Attack Prevention
.
(Stored procedures are pre-defined SQL statements that are stored in your
database and can be executed by your application. They are like functions or
methods in programming languages, but they operate on the database level. You
can use stored procedures to perform complex or repetitive tasks, such as
inserting, updating, deleting, or querying data. You can also pass parameters to
stored procedures, which are variables that hold the values of your application's
input fields.
However, the use of stored procedures presents several challenges. In many cases,
developers fail to fully separate user input from SQL logic within stored procedures,
developers fail to fully separate user input from SQL logic within the procedure itself. For example, allowing
unsanitized user input directly within a stored procedure can negate the protection provided by the procedure,
leaving the application vulnerable to SQL injection. Furthermore, the complexity of stored procedures may
discourage developers from using them or lead to improper implementation. This could result in weak security
measures or the bypassing of critical preventive steps.

7. SQL Attack Prevention
Despite its importance, many applications fail to implement robust input validation
practices.
Inadequate or improperly designed input validation can allow harmful inputs to bypass
security measures, enabling SQL injection attacks.
Furthermore, overly stringent validation may lead to false negatives, rejecting
legitimate user input, while lenient validation can result in the acceptance of dangerous
input.
The complexity of handling diverse input types across various user interaction points,
such as web forms, cookies, HTTP headers, and URL parameters, compounds the
difficulty of achieving comprehensive and effective input validation.
Attackers may exploit SQL injection vulnerabilities to bypass encryption mechanisms,
expose encryption keys, or retrieve encrypted data through malicious query
manipulation.

8. SQL Attack Prevention
Additionally, poor encryption implementation, such as weak algorithms, improper key
management, or insecure storage of decryption keys, can introduce further
vulnerabilities.
By restricting database access and capabilities, the impact of a SQL injection attack can
be minimized, as attackers will be unable to perform actions outside their limited
access scope. However, many organizations fail to implement stringent access controls
or regularly review and update privilege levels, resulting in over-permissioned
accounts.
Table 2: Model Comparison
Model Accuracy Precision Recall F1=Score
CNN+BILSTM 99.55 99.17 99.48 99.32

9. Thank you for listening
Q & A