Publication Date

Fall 2010

Degree Type

Master's Project

Degree Name

Master of Science (MS)

Department

Computer Science

First Advisor

Mark Stamp

Second Advisor

Chris Pollett

Third Advisor

Robert Chun

Keywords

Web Security SQL Injection Attacks

Abstract

Personally identifiable information (PII) is information regarding things such as bank accounts, retirement or stock investment accounts, credit card accounts, medical records, or insurance claims. There is a need to protect the PII in databases that are connected to the ubiquitous, global network that is the Internet. If there is any vulnerability in the protection in a system that holds PII, then it presents an opportunity for an unauthorized person to access this PII. One of the techniques available to would- be information thieves is SQL injection (SQL-I). In this project, a system is developed to analyze the values submitted by users through HTML forms and look for possible attack patterns. Once the system finds such a pattern, it blocks the attack and makes a record of the activity. If an attacker continues to pass such attack patterns, the system blocks access by this user altogether. A mechanism is included to block users who attempt to log in at an abnormally high rate. This provides a combination of pattern-based detection and anomaly-based detection to create a reasonably robust intrusion detection system, with respect to SQL-I attacks.

Download

Share

COinS