Anomaly detection of web-based attacks
Proceedings of the 10th ACM conference on Computer and communications security
The application of antigenic search techniques to time series forecasting
GECCO '05 Proceedings of the 7th annual conference on Genetic and evolutionary computation
Undermining an anomaly-based intrusion detection system using common exploits
RAID'02 Proceedings of the 5th international conference on Recent advances in intrusion detection
Tracing SQL attacks via neural networks
PPAM'07 Proceedings of the 7th international conference on Parallel processing and applied mathematics
A learning-based approach to the detection of SQL attacks
DIMVA'05 Proceedings of the Second international conference on Detection of Intrusions and Malware, and Vulnerability Assessment
Learning long-term dependencies in NARX recurrent neural networks
IEEE Transactions on Neural Networks
Soft computing techniques for intrusion detection of SQL-based attacks
ACIIDS'10 Proceedings of the Second international conference on Intelligent information and database systems: Part I
| Hi-index | 0.00 |
In the paper we present a new approach based on application of neural networks to detect SQL attacks. SQL attacks are those attacks that take the advantage of using SQL statements to be performed. The problem of detection of this class of attacks is transformed to time series prediction problem. SQL queries are used as a source of events in a protected environment. To differentiate between normal SQL queries and those sent by an attacker, we divide SQL statements into tokens and pass them to our detection system, which predicts the next token, taking into account previously seen tokens. In the learning phase tokens are passed to a recurrent neural network (RNN) trained by backpropagation through time (BPTT) algorithm. Then, two coefficients of the rule are evaluated. The rule is used to interpret RNN output. In the testing phase RNN with the rule is examined against attacks and legal data to find out how evaluated rule affects efficiency of detecting attacks. All experiments were conducted on Jordan network. Experimental results show the relationship between the rule and a length of SQL queries.