TECHNICAL FIELD

Embodiments relate to techniques for detecting Structured Query Language (SQL) injection. More particularly, embodiments relate to techniques for detecting intrusion attempts via SQL injection by detecting statistically improbable SQL statements.

BACKGROUND

SQL injection is an attack technique in which malicious SQL statements are inserted into an entry field, or other entry point, to attack a security vulnerability. Detection of database intrusion using techniques such as SQL injection can be difficult because the malicious SQL statement is often both correct and valid according to the database engine. For example, an application may list all of a user's contacts in response to “select*from contacts where user=foo′”. This valid SQL statement can also be utilized maliciously by a hacker to extract contact information. For example, a potential hacker may be able to retrieve all of the contents of a table by adding an always-true OR clause to the WHERE predicate of a SQL statement via a hacked variable. For example, a variable called userName might be used to construct a SQL statement such as “select*from important_table where user=+userName;”. A hacker could in theory change the variable userName to something like “1 OR 1=1”. The resulting SQL statement would be “select*from important_table where user=1 OR 1=1”). The WHERE predicate is then rendered useless.

Further, hacked applications can, in theory, also issue arbitrary SQL statements against a database. For example, a hacker could retrieve a list of all existing tables in a database or the contents of any table even though the application was not designed to provide access such as this (and may even be designed to prevent it). In general, errant or malicious SQL statements can be difficult to detect.

