Attack Intention Estimation Based on Syntax Analysis and Dynamic Analysis for SQL Injection

SQL injections lead to serious damage such as leakage of personal information and are prevalent online. Web Application Firewalls (WAFs) are used to detect SQL injections, but its detection is not perfect. Therefore, to validate detected attacks, a more detailed manual analysis is required. Furthermore, due to confidentiality and availability, it is often impossible to obtain information on monitored web servers. In this paper, we propose a method to identify the intention of SQL injections in order to shorten the analysis time in the situation where limited information is available. The proposed method analyzes only a partial SQL query in an HTTP request and estimates its intention by syntax analysis and emulating. Evaluation results revealed that the proposed method was able to correctly identify the intention with an accuracy of 83.1% and 71.9% for an artificial dataset and a real-world dataset respectively.