Augmented attack tree modeling of SQL injection attacks

Jie Wang; Raphael C.W. Phan; John N. Whitley; David J. Parish

doi:10.1109/ICIME.2010.5478321

Augmented attack tree modeling of SQL injection attacks

Jie Wang
, Raphael C.W. Phan
, John N. Whitley
, David J. Parish

Research output: Chapter in Book/Report/Conference proceeding › Conference Paper › Research › peer-review

21 Citations (Scopus)

Abstract

The SQL injection attacks (SQLIAs) vulnerability is extremely widespread and poses a serious security threat to web applications with built-in access to databases. The SQLIA adversary intelligently exploits the SQL statement parsing operation by web servers via specially constructed SQL statements that subtly lead to non-explicit executions or modifications of corresponding database tables. In this paper, we present a formal and methodical way of modeling SQLIAs by way of augmented attack trees. This modeling explicitly captures the particular subtle incidents triggered by SQLIA adversaries and corresponding state transitions. To the best of our knowledge, this is the first known attack tree modelling of SQL injection attacks.

Original language	English
Title of host publication	ICIME 2010 - 2010 2nd IEEE International Conference on Information Management and Engineering
Pages	182-186
Number of pages	5
DOIs	https://doi.org/10.1109/ICIME.2010.5478321
Publication status	Published - 2010
Externally published	Yes
Event	IEEE International Conference on Information Management and Engineering 2010 - Chengdu, China Duration: 16 Apr 2010 → 18 Apr 2010 Conference number: 2nd https://ieeexplore.ieee.org/xpl/conhome/5472906/proceeding (Proceedings)

Publication series

Name	ICIME 2010 - 2010 2nd IEEE International Conference on Information Management and Engineering
Volume	6

Conference

Conference	IEEE International Conference on Information Management and Engineering 2010
Abbreviated title	ICIME 2010
Country/Territory	China
City	Chengdu
Period	16/04/10 → 18/04/10
Internet address	https://ieeexplore.ieee.org/xpl/conhome/5472906/proceeding (Proceedings)

Keywords

Augmented attack tree
Modelling
SQL injection attack

Access to Document

10.1109/ICIME.2010.5478321

Cite this

Wang, J., Phan, R. C. W., Whitley, J. N., & Parish, D. J. (2010). Augmented attack tree modeling of SQL injection attacks. In ICIME 2010 - 2010 2nd IEEE International Conference on Information Management and Engineering (pp. 182-186). (ICIME 2010 - 2010 2nd IEEE International Conference on Information Management and Engineering; Vol. 6). https://doi.org/10.1109/ICIME.2010.5478321

@inproceedings{f1a9cbe93d664f98bd4f87cef37d6ad6,

title = "Augmented attack tree modeling of SQL injection attacks",

abstract = "The SQL injection attacks (SQLIAs) vulnerability is extremely widespread and poses a serious security threat to web applications with built-in access to databases. The SQLIA adversary intelligently exploits the SQL statement parsing operation by web servers via specially constructed SQL statements that subtly lead to non-explicit executions or modifications of corresponding database tables. In this paper, we present a formal and methodical way of modeling SQLIAs by way of augmented attack trees. This modeling explicitly captures the particular subtle incidents triggered by SQLIA adversaries and corresponding state transitions. To the best of our knowledge, this is the first known attack tree modelling of SQL injection attacks.",

keywords = "Augmented attack tree, Modelling, SQL injection attack",

author = "Jie Wang and Phan, \{Raphael C.W.\} and Whitley, \{John N.\} and Parish, \{David J.\}",

note = "Copyright: Copyright 2010 Elsevier B.V., All rights reserved.; IEEE International Conference on Information Management and Engineering 2010, ICIME 2010 ; Conference date: 16-04-2010 Through 18-04-2010",

year = "2010",

doi = "10.1109/ICIME.2010.5478321",

language = "English",

isbn = "9781424452644",

series = "ICIME 2010 - 2010 2nd IEEE International Conference on Information Management and Engineering",

pages = "182--186",

booktitle = "ICIME 2010 - 2010 2nd IEEE International Conference on Information Management and Engineering",

url = "https://ieeexplore.ieee.org/xpl/conhome/5472906/proceeding",

}

Wang, J, Phan, RCW, Whitley, JN & Parish, DJ 2010, Augmented attack tree modeling of SQL injection attacks. in ICIME 2010 - 2010 2nd IEEE International Conference on Information Management and Engineering. ICIME 2010 - 2010 2nd IEEE International Conference on Information Management and Engineering, vol. 6, pp. 182-186, IEEE International Conference on Information Management and Engineering 2010, Chengdu, China, 16/04/10. https://doi.org/10.1109/ICIME.2010.5478321

Augmented attack tree modeling of SQL injection attacks. / Wang, Jie; Phan, Raphael C.W.; Whitley, John N. et al.
ICIME 2010 - 2010 2nd IEEE International Conference on Information Management and Engineering. 2010. p. 182-186 (ICIME 2010 - 2010 2nd IEEE International Conference on Information Management and Engineering; Vol. 6).

Research output: Chapter in Book/Report/Conference proceeding › Conference Paper › Research › peer-review

TY - GEN

T1 - Augmented attack tree modeling of SQL injection attacks

AU - Wang, Jie

AU - Phan, Raphael C.W.

AU - Whitley, John N.

AU - Parish, David J.

N1 - Conference code: 2nd

PY - 2010

Y1 - 2010

N2 - The SQL injection attacks (SQLIAs) vulnerability is extremely widespread and poses a serious security threat to web applications with built-in access to databases. The SQLIA adversary intelligently exploits the SQL statement parsing operation by web servers via specially constructed SQL statements that subtly lead to non-explicit executions or modifications of corresponding database tables. In this paper, we present a formal and methodical way of modeling SQLIAs by way of augmented attack trees. This modeling explicitly captures the particular subtle incidents triggered by SQLIA adversaries and corresponding state transitions. To the best of our knowledge, this is the first known attack tree modelling of SQL injection attacks.

AB - The SQL injection attacks (SQLIAs) vulnerability is extremely widespread and poses a serious security threat to web applications with built-in access to databases. The SQLIA adversary intelligently exploits the SQL statement parsing operation by web servers via specially constructed SQL statements that subtly lead to non-explicit executions or modifications of corresponding database tables. In this paper, we present a formal and methodical way of modeling SQLIAs by way of augmented attack trees. This modeling explicitly captures the particular subtle incidents triggered by SQLIA adversaries and corresponding state transitions. To the best of our knowledge, this is the first known attack tree modelling of SQL injection attacks.

KW - Augmented attack tree

KW - Modelling

KW - SQL injection attack

UR - https://www.scopus.com/pages/publications/77954667442

U2 - 10.1109/ICIME.2010.5478321

DO - 10.1109/ICIME.2010.5478321

M3 - Conference Paper

AN - SCOPUS:77954667442

SN - 9781424452644

T3 - ICIME 2010 - 2010 2nd IEEE International Conference on Information Management and Engineering

SP - 182

EP - 186

BT - ICIME 2010 - 2010 2nd IEEE International Conference on Information Management and Engineering

T2 - IEEE International Conference on Information Management and Engineering 2010

Y2 - 16 April 2010 through 18 April 2010

ER -

Augmented attack tree modeling of SQL injection attacks

Abstract

Publication series

Conference

Keywords

Access to Document

Other files and links

Cite this