Grégor Quétel, Laurent Pautet, Éric Alata et al. · Zenodo (CERN European Organization for Nuclear Research) · 2025
Dataset Description Superviz25-SQL is an SQL Injection Detection Dataset made to evaluate unsupervised SQL Injection detection techniques. The dataset allows to compare the capability of mechanisms trained on the benign workload of a specific database deployment to detect SQL Injection attack targeting this deployment. We provide a test and train split, the train set consists of 335306 benign queries. The test set comprise 3017390 normal samples and 336281 malicious samples (90:10). Some queries typical of insider attacks are also contained in the dataset (n=1089). The dataset offers more than the SQL query and its label as extended metadata is provided to facilitate the comparison of detection approaches. For instance the attack technique information allows to compare the effectiveness of detection mechanism across existing SQL Injection techniques. Furthermore, the user input field allows the comparison of approaches basing their detection on full queries to those solely using the user inputs. The code used for the generation of this dataset is available at gquetel/sqlia-dataset. If you use this dataset, please acknowledge it by citing the original paper: Grégor Quetel, Eric Alata, Pierre-François Gimenez, Thomas Robert, Laurent Pautet. Superviz25-SQL: high-quality dataset to empower unsupervised SQL injection detection systems. 1st International Workshop on Assessment with New methodologies, Unified Benchmarks, and environments, of Intrusion detection and response Systems (ANUBIS), Sep 2025, Toulouse, France. ⟨hal-05314211⟩ This work has been partially supported by the French National Research Agency under the France 2030 label (Superviz ANR-22-PECY-0008). The views reflected herein do not necessarily reflect the opinion of the French government. Usage The proposed training and testing sets can easily be loaded using python and pandas as follows: import pandas as pd df = pd.read_csv( "dataset.csv", dtype={ "full_query": str, "label": int, "user_inputs": str, "attack_stage": str, "tamper_method": str, "attack_status": str, "statement_type": str, "query_template_id": str, "attack_id": str, "attack_technique": str, "split": str, }, ) df_train = df[df["split"] == "train"] df_test = df[df["split"] == "test"]
Cited by 0Open access
Quetel, Grégor, Pautet, Laurent, Alata, Eric et al. · Zenodo (CERN European Organization for Nuclear Research) · 2025
Dataset Description Superviz25-SQL is an SQL Injection Detection Dataset made to evaluate unsupervised SQL Injection detection techniques. The dataset allows to compare the capability of mechanisms trained on the benign workload of a specific database deployment to detect SQL Injection attack targeting this deployment. We provide a test and train split, the train set consists of 335306 benign queries. The test set comprise 3017390 normal samples and 336281 malicious samples (90:10). Some queries typical of insider attacks are also contained in the dataset (n=1089). The dataset offers more than the SQL query and its label as extended metadata is provided to facilitate the comparison of detection approaches. For instance the attack technique information allows to compare the effectiveness of detection mechanism across existing SQL Injection techniques. Furthermore, the user input field allows the comparison of approaches basing their detection on full queries to those solely using the user inputs. The code used for the generation of this dataset is available at gquetel/sqlia-dataset. If you use this dataset, please acknowledge it by citing the original paper: Grégor Quetel, Eric Alata, Pierre-François Gimenez, Thomas Robert, Laurent Pautet. Superviz25-SQL: high-quality dataset to empower unsupervised SQL injection detection systems. 1st International Workshop on Assessment with New methodologies, Unified Benchmarks, and environments, of Intrusion detection and response Systems (ANUBIS), Sep 2025, Toulouse, France. ⟨hal-05314211⟩ This work has been partially supported by the French National Research Agency under the France 2030 label (Superviz ANR-22-PECY-0008). The views reflected herein do not necessarily reflect the opinion of the French government. Usage The proposed training and testing sets can easily be loaded using python and pandas as follows: import pandas as pd df = pd.read_csv( "dataset.csv", dtype={ "full_query": str, "label": int, "user_inputs": str, "attack_stage": str, "tamper_method": str, "attack_status": str, "statement_type": str, "query_template_id": str, "attack_id": str, "attack_technique": str, "split": str, }, ) df_train = df[df["split"] == "train"] df_test = df[df["split"] == "test"]
Cited by 0Open access
Arjun Thimmappa · 2018
ijseries.com is your first and best source for all of the information you’re looking for. From general topics to more of what you would expect to find here, ijseries.com has it all. We hope you find what you are searching for!
Cited by 1
B. Deva Priyaa, M. Indra Devi · 2016
The use of database driven web applications are increasing every day. Attacks on those web applications are also increasing. One of the common web application attacks is SQL Injection attack. These attacks are a code injection or insertion of SQL query via input data from the client to the application. There are many detection techniques implemented, but they have focused on the SQL structure at the application level. So those techniques failed to detect some of the attacks at the database level. The existing approaches use classification techniques and suitable kernel functions to detect the attack at the database level. As the SVM classification is the supervised learning algorithm, the unknown attacks can't be detected. In this paper, we propose a hybrid framework using the EDADT (Efficient Data Adaptive Decision Tree) algorithm which is the semi - supervised algorithm and SVM classification algorithm. It uses the internal query tree from the database log for good performance of framework. To get internal query tree, the query tree is converted to n - dimensional feature vector by using multi - dimensional sequence. The semantic features are used as the component of feature vector. And also the syntactic and semantic feature is used to generate multi - dimensional sequences. Then the extracted feature is converted into numeric value, if the feature contains any string value. Experimental results show that the proposed approach is more accurate in detecting the attacks than existing approaches.
Cited by 16
Roy, Prince · TIB Data Manager · 2024
Cited by 0Open access
Kutypa, Matouš · Brno University of Technology Digital Library (Brno University of Technology) · 2013
Bakalářská práce je zaměřena na problematiku bezpečnostní chyby SQL injection. V práci jsou popsány běžně používané postupy při útocích na informační systémy a jsou také probrány možnosti obrany včetně uvedení způsobů správné validace vstupů aplikace. Teoretická část práce obsahuje nezbytný základ, jaký by měl penetrační tester znát, aby byl schopen prověřit vstupy aplikace na odolnost proti útokům typu SQL injection. Součástí práce je analýza, návrh a implementace nástroje specializovaného na detekci obtížně zjistitelných zranitelností webové aplikace. Implementovaný nástroj byl otestován a porovnán s jinými běžně dostupnými nástroji. V rámci práce byla také vytvořena webová aplikace pro demonstraci různých variant zranitelných vstupů SQL injection.
Cited by 0
Anamika Joshi, V. Geetha · 2014
In the present world, the web is the firmest and most common medium of communication and business interchange. Every day, millions of data are loaded through various channels on the web by users and user input can be malicious. Therefore, security becomes a very important aspect of web applications. Since they are easily accessible, they are prone to many vulnerabilities which if neglected can cause harm. The attackers make use of these loopholes to gain unauthorized access by performing various illegal activities. SQL Injection is one such attack which is easy to perform but difficult to detect because of its varied types and channel. This may result in theft, leak of personal data or loss of property. In this paper we have analyzed the existing solutions to the problems such as AMNESIA [1] and SQLrand [3] and their limitations. We have devised a classifier for detection of SQL Injection attacks. The proposed classifier uses combination of Naïve Bayes machine learning algorithm and Role Based Access Control mechanism for detection. The proposed model is tested based on the test cases derived from the three SQLIA attacks: comments, union and tautology.
Cited by 104
Hossain Shahriar, Sarah North, Wei-Chuen Chen · Zenodo (CERN European Organization for Nuclear Research) · 2013
SQL Injection (SQLI) is a common vulnerability found in web applications. The starting point of SQLI attack is the client-side (browser). If attack inputs can be detected early at the browse side, then it could be thwarted early by not forwarding the malicious inputs to the server-side for further processing. This paper presents a client-side approach to detect SQLI attacks1 . The client-side accepts shadow SQL queries from the server-side and checks any deviation between shadow queries with dynamic queries generated with user supplied inputs. We measure the deviation of shadow query and dynamic query based on conditional entropy metrics and propose four metrics in this direction. We evaluate the approach with three PHP applications containing SQLI vulnerabilities. The evaluation results indicate that our approach can detect well-known SQLI attacks early at the client-side and impose negligible overhead.
Cited by 3Open access
M B Deeksha, Dr. Kavyasri M N, K. Anusha et al. · INTERNATIONAL JOURNAL OF NOVEL TRENDS AND INNOVATION · 2025
The increasing reliance on web-based applications and databases has increased the risk of SQL Injection Attacks (SQLIAs), which is one of the most widespread threats to web platforms. SQLIAs take advantage of weaknesses in user input validation to run malicious SQL queries, leading to unauthorized access, data theft, and extreme economic loss. In response to these issues, many research studies have looked into machine learning (ML) and deep learning (DL) solutions to improve SQLIA detection. Methods like 2D-Convolutional Neural Networks (2D-CNNs), Elastic- Pooling CNNs, Multi-Layer Perceptrons (MLPs), and hybrid approaches like CNN-BiLSTM have shown higher accuracy and adaptability compared to conventional rule-based systems. These models utilize features like word embeddings, syntactic parsing, and vector representations to detect SQLIA patterns efficiently. Using Kaggle and other data sets, experiments show the resilience of DL models in real-time detection and capacity to classify intricate SQLIAs, guaranteeing a substantial improvement in protecting database-driven systems.
Cited by 0Open access
Jai Puneet Singh · Spectrum Research Repository (Concordia University) · 2016
SQL Injection is one of the vulnerabilities in OWASPs Top Ten List for Web Based Application Exploitation.These types of attacks takes place on Dynamic Web applications as they interact with the databases for the various operations.Current Content Management System like Drupal, Joomla or Wordpress have all the information stored in their databases. A single intrusion into these types of websites can lead to overall control of websites by the attacker. Researchers are aware of the basic SQL Injection attacks but there are numerous SQL Injection attacks which are yet to be Prevented and Detected. Over here, we present the extensive review for the Advanced SQL Injection attack such as Fast Flux Sql Injection, Compounded SQL Injection and Deep Blind SQL Injection. We also analyze the detection and prevention using the classical methods as well as modern approaches. We will be discussing the Comparative Evaluation for prevention of SQL Injection.
Cited by 1Open access
Shahriar, Hossain, North, Sarah, Wei-Chuen Chen · Zenodo (CERN European Organization for Nuclear Research) · 2013
SQL Injection (SQLI) is a common vulnerability found in web applications. The starting point of SQLI attack is the client-side (browser). If attack inputs can be detected early at the browse side, then it could be thwarted early by not forwarding the malicious inputs to the server-side for further processing. This paper presents a client-side approach to detect SQLI attacks1 . The client-side accepts shadow SQL queries from the server-side and checks any deviation between shadow queries with dynamic queries generated with user supplied inputs. We measure the deviation of shadow query and dynamic query based on conditional entropy metrics and propose four metrics in this direction. We evaluate the approach with three PHP applications containing SQLI vulnerabilities. The evaluation results indicate that our approach can detect well-known SQLI attacks early at the client-side and impose negligible overhead.
Cited by 0Open access
Jai Puneet Singh · Theoretical and Applied Informatics · 2017
SQL Injection is one of the vulnerabilities in OWASP's Top Ten List for Web Based Application Exploitation. These type of attacks take place on Dynamic Web applications as they interact with databases for various operations. Current Content Management System like Drupal, Joomla or Wordpress have all information stored in their databases. A single intrusion into these type of websites can lead to overall control of websites by an attacker. Researchers are aware of basic SQL Injection attacks, but there are numerous SQL Injection attacks which are yet to be prevented and detected. Over here, we present the extensive review for the Advanced SQL Injection attack such as Fast Flux SQL Injection, Compounded SQL Injection and Deep Blind SQL Injection. We also analyze the detection and prevention using the classical methods as well as modern approaches. We will be discussing the Comparative Evaluation for prevention of SQL Injection.
Cited by 27
Sonali Mishra · 2019
Sharing information over the Internet over multiple platforms and web-applications has become a quite common phenomenon in the recent times. The web-based applications that accept critical information from users store this information in databases. These applications and the databases connected to them are susceptible to all kinds of information security threats due to being accessible through the Internet. The threats include attacks such as Cross Side Scripting (CSS), Denial of Service Attack (DoS0, and Structured Query Language (SQL) Injection attacks. SQL Injection attacks fall under the top ten vulnerabilities when we talk about web-based applications. Through this kind of attack, the attacker can steal critical and confidential information and hence it could have damaging effects on a business or organization. The effects could range from monetary loss, leaking confidential business information, decrease in company’s stock market value or any combination of these. In this paper we have used an algorithm called Gradient Boosting Classifier from ensemble machine learning approaches to classify and detect SQL Injection attacks.
Cited by 16Open access
Atefeh Tajpour, Suhaimi Ibrahim, Maslin Masrom · International Journal of Advancements in Computing Technology · 2011
SQL injection is a type of attack which the attacker adds Structured Query Language code to a web form input box to gain access or make changes to data. SQL injection vulnerability allows an attacker to flow commands directly to a web application's underlying database and destroy functionality or confidentiality. Researchers have proposed different tools to detect and prevent this vulnerability. In this paper we present SQL injection attack types and also current techniques which can detect or prevent these attacks. Finally we evaluate these techniques.
Cited by 33
Jagdish Halde · 2008
Web sites are dynamic, static, and most of the time a combination of both. Web sites need protection in their database to assure security. An SQL injection attacks interactive web applications that provide database services. These applications take user inputs and use them to create an SQL query at run time. In an SQL injection attack, an attacker might insert a malicious SQL query as input to perform an unauthorized database operation. Using SQL injection attacks, an attacker can retrieve or modify confidential and sensitive information from the database. It may jeopardize the confidentiality and security of Web sites which totally depends on databases. This report presents a “code reengineering” that implicitly protects the applications which are written in PHP from SQL injection attacks. It uses an original approach that combines static as well as dynamic analysis. [2] In this report, I mentioned an automated technique for moving out SQL injection vulnerabilities from Java code by converting plain text inputs received from users into prepared statements. [3]
Cited by 5Open access
R. Latha, Dr.E. Ramaraj · International Journal Of Engineering And Computer Science · 2015
Cited by 2
J. Xu, Ming Ni, Danjiang Zhu et al. · 2023
In today's rapid development of digital economy and digital transformation, SQLIA (SQL injection attack) against data infrastructure as a means of illegal access manipulation is a serious threat to data security, SQLIA methods are becoming more and more diverse and complex, and data security is facing serious challenges. SQLIA detection technology has become a research hotspot in the field of data security. At present, many domestic and foreign SQLIA detection technology methods are diverse and have their own characteristics, the SQLIA detection technology can be summarised to better open up new research ideas. In this paper, the current status and research progress of SQLIA detection technology are systematically reviewed. Firstly, the SQL injection attack mechanism is introduced and various injection methods and attack types are summarized. Then, the main techniques of SQLIA detection are analyzed, classified and summarized from four aspects: data analysis, feature training, syntactic semantics and pattern matching. Finally, the principles, advantages and disadvantages of the above four detection methods are summarized and evaluated, and SQLIA detection tools and technologies are compared from multiple indicators. The challenges existing in SQLIA detection methods and corresponding optimization technologies are discussed, and the key research directions in the future are prospeced. It is expected to provide some basic theoretical support and technical direction guidance for the subsequent integration of multiple detection methods, solving the problem of second-order SQL injection and creating a new theory of SQL attack and defense.
Cited by 4
Congcong Shi, Tao Zhang, Yong Yu et al. · Advances in intelligent and soft computing · 2012
Cited by 3
2008
SQL injection attacks potentially affect all applications, especially web applications, that utilize a database backend. While these attacks are generally against the applications and not the database directly, there are some techniques that can be deployed to mitigate the risk at the database server. Database intrusion detection systems are often based on signatures of known exploits and honey tokens, traps set in the database. This paper examines the threat from SQL injection attacks, the reasons traditional database access control is not sufficient to stop them, and some of the techniques used to detect them. Moreover, it proposes a model for an anomalous SQL detector which observes the database traffic from the perspective of the database server itself. The proposed anomaly model can be used in conjunction with the existing methods to give the database server a way to mitigate the SQL injection risk that is a major application security problem.
Cited by 0
Eman Hosam, Hagar Hosny, Walaa Ashraf et al. · 2021
SQL Injection is one of the most popular cyberattacks in which hackers can gain unauthorized access to sensitive data such as customer information, trade secrets, etc. SQL Injection works by injecting malicious SQL code into user input fields in order to illegitimately read, update, or delete database contents. Detecting SQL Injection is a binary classification problem in which it is required to decide whether a user input is malicious (i.e., includes an injected SQL code) or benign. SQL Injection can be detected using rule-based, machine learning, or deep learning techniques. This paper focuses on machine learning techniques for SQL Injection detection. The paper defines 13 relevant features that can be extracted from user inputs, and it presents and evaluates 6 different machine learning algorithms. A feature selection process is also conducted, and the models achieve an accuracy up to 99.6%. The presented models show clear abilities to generalize to unseen data and perform well with a limited training set size. Overall, Logistic Regression is concluded to be the most performing model.
Cited by 25