RECURRENT NEURAL NETWORKS APPROACH TO THE DETECTION OF SQL ATTACKS

Jaroslaw Skaruz, Franciszek Seredynski, Pascal Bouvry

2007

Abstract

In the paper we present a new approach based on application of neural networks to detect SQL attacks. SQL attacks are those attacks that take advantage of using SQL statements to be performed. The problem of detection of this class of attacks is transformed to time series prediction problem. SQL queries are used as a source of events in a protected environment. To differentiate between normal SQL queries and those sent by an attacker, we divide SQL statements into tokens and pass them to our detection system, which predicts the next token, taking into account previously seen tokens. In the learning phase tokens are passed to recurrent neural network (RNN) trained by backpropagation through time (BPTT) algorithm. Teaching data are shifted by one token forward in time with relation to input. The purpose of the testing phase is to predict the next token in the sequence. All experiments were conducted on Jordan and Elman networks using data gathered from PHP Nuke portal. Experimental results show that the Jordan network outperforms the Elman network predicting correctly queries of the length up to ten.

References

  1. Almgren, M., Debar, H., and Dacier, M. (2000). A lightweight tool for detecting web server attacks. In Proceedings of the ISOC Symposium on Network and Distributed Systems Security.
  2. Drake, P. R. and Miller, K. A. (2002). Improved selffeedback gain in the context layer of a modified elman neural network. In Mathematical and Computer Modelling of Dynamical Systems.
  3. Kendall, M. and Ord, J. (1999). Time Series.
  4. Kruegel, C. and Vigna, G. (2003). Anomaly detection of web-based attacks. In Proceedings of the 10th ACM Conference on Computer and Communication Security (CCS 7803).
  5. Nunn, I. and White, T. (2005). The application of antigenic search techniques to time series forecasting. In Proceedings of the Genetic and Evolutionary Computation Conference (GECCO).
  6. Pollock, D. (1999). A handbook of time-series analysis, signal processing and dynamics. In Academic Press.
  7. Valeur, F., Mutz, D., and Vigna, G. (2005). A learningbased approach to the detection of sql attacks. In Proceedings of the Conference on Detection of Intrusions and Malware and Vulnerability Assessment.
Download


Paper Citation


in Harvard Style

Skaruz J., Seredynski F. and Bouvry P. (2007). RECURRENT NEURAL NETWORKS APPROACH TO THE DETECTION OF SQL ATTACKS . In Proceedings of the Ninth International Conference on Enterprise Information Systems - Volume 2: ICEIS, ISBN 978-972-8865-89-4, pages 191-197. DOI: 10.5220/0002352901910197


in Bibtex Style

@conference{iceis07,
author={Jaroslaw Skaruz and Franciszek Seredynski and Pascal Bouvry},
title={RECURRENT NEURAL NETWORKS APPROACH TO THE DETECTION OF SQL ATTACKS},
booktitle={Proceedings of the Ninth International Conference on Enterprise Information Systems - Volume 2: ICEIS,},
year={2007},
pages={191-197},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0002352901910197},
isbn={978-972-8865-89-4},
}


in EndNote Style

TY - CONF
JO - Proceedings of the Ninth International Conference on Enterprise Information Systems - Volume 2: ICEIS,
TI - RECURRENT NEURAL NETWORKS APPROACH TO THE DETECTION OF SQL ATTACKS
SN - 978-972-8865-89-4
AU - Skaruz J.
AU - Seredynski F.
AU - Bouvry P.
PY - 2007
SP - 191
EP - 197
DO - 10.5220/0002352901910197