Effective SQL Injection Detection: A Fusion of Binary Olympiad Optimizer and Classification Algorithm

被引:5
作者
Arasteh, Bahman [1 ,2 ]
Bouyer, Asgarali [1 ,3 ]
Sefati, Seyed Salar [1 ,4 ]
Craciunescu, Razvan [4 ]
机构
[1] Istinye Univ, Fac Engn & Nat Sci, Dept Software Engn, TR-34460 Istanbul, Turkiye
[2] Khazar Univ, Dept Comp Engn, AZ-1096 Baku, Azerbaijan
[3] Azarbaijan Shahid Madani Univ, Fac Comp Engn, Tabriz 5375171379, Iran
[4] Natl Univ Sci & Technol Politehn Bucharest, Fac Elect Telecommun & Informat Technol, Bucharest 060042, Romania
基金
欧盟地平线“2020”;
关键词
security; SQL injection attacks; binary Olympiad optimization algorithm; feature selection; machine learning algorithms; accuracy;
D O I
10.3390/math12182917
中图分类号
O1 [数学];
学科分类号
0701 ; 070101 ;
摘要
Since SQL injection allows attackers to interact with the database of applications, it is regarded as a significant security problem. By applying machine learning algorithms, SQL injection attacks can be identified. Problem: In the training stage of machine learning methods, effective features are used to develop an optimal classifier that is highly accurate. The specification of the features with the highest efficacy is considered to be an NP-complete combinatorial optimization challenge. Selecting the most effective features refers to the procedure of identifying the smallest and most effective features in the dataset. The rationale behind this paper is to optimize the accuracy, precision, and sensitivity parameters of the SQL injection attack detection method. Method: In this paper, a method for identifying SQL injection attacks was suggested. In the first step, a particular training dataset that included 13 features was developed. In the second step, to specify the best features of the dataset, a specific binary variety of the Olympiad optimization algorithm was developed. Various machine learning algorithms were used to create the optimal attack detector. Results: Based on the experiments carried out, the suggested SQL injection detector using an artificial neural network and the feature selector can achieve 99.35% accuracy, 100% precision, and 100% sensitivity. Owing to selecting about 30% of the effective features, the proposed method enhanced the efficacy of SQL injection detectors.
引用
收藏
页数:21
相关论文
共 29 条
[1]   SQL-injection vulnerability scanning tool for automatic creation of SQL-injection attacks [J].
Ali, Abdul Bashah Mat ;
Shakhatreh, Ala' Yaseen Ibrahim ;
Abdullah, Mohd Syazwan ;
Alostad, Jasem .
WORLD CONFERENCE ON INFORMATION TECHNOLOGY (WCIT-2010), 2011, 3
[2]   Detecting SQL injection attacks by binary gray wolf optimizer and machine learning algorithms [J].
Arasteh, Bahman ;
Aghaei, Babak ;
Farzad, Behnoud ;
Arasteh, Keyvan ;
Kiani, Farzad ;
Torkamanian-Afshar, Mahsa .
NEURAL COMPUTING & APPLICATIONS, 2024, 36 (12) :6771-6792
[3]   A bioinspired discrete heuristic algorithm to generate the effective structural model of a program source code [J].
Arasteh, Bahman ;
Sadegi, Razieh ;
Arasteh, Keyvan ;
Gunes, Peri ;
Kiani, Farzad ;
Torkamanian-Afshar, Mahsa .
JOURNAL OF KING SAUD UNIVERSITY-COMPUTER AND INFORMATION SCIENCES, 2023, 35 (08)
[4]   Clustered design-model generation from a program source code using chaos-based metaheuristic algorithms [J].
Arasteh, Bahman .
NEURAL COMPUTING & APPLICATIONS, 2023, 35 (04) :3283-3305
[5]   ARAZ: A software modules clustering method using the combination of particle swarm optimization and genetic algorithms [J].
Arasteh, Bahman ;
Sadegi, Razieh ;
Arasteh, Keyvan .
INTELLIGENT DECISION TECHNOLOGIES-NETHERLANDS, 2020, 14 (04) :449-462
[6]  
Buehrer G., 2005, Proceedings of the 5th international workshop on Software engineering and middleware, P106, DOI [10.1145/1108473.1108496., DOI 10.1145/1108473.1108496]
[7]  
Buja Geogiana, 2014, 2014 IEEE Symposium on Computer Applications and Industrial Electronics (ISCAIE), P60, DOI 10.1109/ISCAIE.2014.7010210
[8]  
Clarke J., 2012, SQL Injection Attacks and Defense, V2nd ed., P409
[9]   JDBC checker: A static analysis tool for SQL/JDBC applications [J].
Gould, C ;
Su, ZD ;
Devanbu, P .
ICSE 2004: 26TH INTERNATIONAL CONFERENCE ON SOFTWARE ENGINEERING, PROCEEDINGS, 2004, :697-698
[10]   Research on the Technology of Detecting the SQL Injection Attack and Non-Intrusive Prevention in WEB System [J].
Hu, Haibin .
MATERIALS SCIENCE, ENERGY TECHNOLOGY, AND POWER ENGINEERING I, 2017, 1839