SQLrand: Preventing SQL Injection Attacks

By Stephen W. Boyd, Angelos Dennis Keromytis. International Conference on Applied Cryptography and Network Security, 2004

513 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Information Systems, Materials Chemistry

View Paper: https://www.semanticscholar.org/paper/07c8dc37b1061784f3b55cf3ca5d2bc735e1693c

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Information Systems

In Materials Chemistry

Citations in the corpus

Cybersecurity data science: an overview from machine learning perspective (2020, background): “…mentioned above, privilege escalation [29], password attack [30], insider threat [31], man-in-the-middle [32], advanced persistent threat [33], SQL injection attack [34], cryptojacking attack [35], web application attack [30] etc. are well-known as security incidents in the ﬁeld of cybersecurity.”
Defending Against Injection Attacks Through Context-Sensitive String Evaluation (2005, methodology): “SQLrand preprocesses the source code of applications and replaces all SQL commands with encoded versions.”
A Classification of SQL Injection Attacks and Countermeasures (2006, methodology): “SQLrand [5] is an approach based on instruction-set randomization.”
Sound and precise analysis of web applications for injection vulnerabilities (2007, methodology): “Boyd and Keromytis sought to enforce this via instruction set randomization [14], i.e., by randomizing the SQL keywords in the web application, so that users could not guess the keywords [ 1 ].”
Taint-Enhanced Policy Enforcement: A Practical Approach to Defeat a Wide Range of Attacks (2006, methodology): “SQLrand [4] defeats SQL injection by randomizing the textual representation of SQL commands.”
AI-Driven Cybersecurity: An Overview, Security Intelligence Modeling and Research Directions (2021, unknown): “…[26, 36] SQL injection attack To execute malicious SQL statements for backend database manipulation to access information, typically used to attack data-driven applications [37] Attacks on IoT devices To make it part of a DDoS attack and unauthorized access to data being collected by the device [3]”
A Comprehensive Study of Security of Internet-of-Things (2017, background): “In situations where the attacker has no knowledge of the database’s tables, forcing an exception may reveal more details about each table and the names of its fields [75].”
The essence of command injection attacks in web applications (2006, background): “SQLrand, a recently pr oposed instruction set randomization for SQL in web applications, has a similar effect [4].”
Using parse tree validation to prevent SQL injection attacks (2005, methodology): “Boyd and Keremytis [1, 13] developed SQLRand, a technique that modifies the tokens of the SQL language: Each token type includes a prepended integer.”
Prompt Injection attack against LLM-integrated Applications (2023, methodology): “This is inspired by traditional injection attacks such as SQL injection [10,14,25] and XSS attacks [23,27,63], where specially crafted payloads disturb the routine execution of a program by encapsulating previous commands and misinterpreting malev-olent input as a new command.”