System and method for correlating between HTTP requests and SQL queries

1. A method for real-time correlating between requests to a web server and requests to a database server, comprising:

identifying correlated pairs of structured query language (SQL) templates and uniform resource locators (URLs);

for each incoming request to the database server, binding a web application context in which the request to the database server is made;

wherein identifying the correlated pairs of SQL templates and URLs, further comprises:

creating a first matrix, wherein each row of the first matrix represents a URL and each column represents a SQL template and wherein each entry in the first matrix includes a counter;

extracting the URL from an incoming HTTP request;

inserting the URL to an available row in the first matrix;

adding the incoming HTTP request to a list of pending HTTP requests for the URL:

converting an incoming SQL query to a SQL template;

inserting the SQL template to an available column in the first matrix; incrementing the counter of each entry of a respective URL that has at least one pending HTTP request; and marking all entries in the first matrix having a counter's value greater than a predefined threshold.

2. The method of claim 1 , wherein requests to web servers are hypertext transfer protocol (HTTP) requests and wherein requests to database server are SQL queries.

3. The method of claim 2 , wherein binding the web application context, to the SQL query, further comprises:

receiving a SQL query;

converting the SQL query to a SQL template;

searching in a SQL NBP for URLs that correlate to the SQL template;

for HTTP request with a correlated URL,

matching between parameters of the HTTP request and literals of the SQL query;

computing a matching score for each HTTP request;

selecting the HTTP request with the highest correlate score; and

binding the web context web application context of the selected HTTP request to the incoming SQL query.

4. The method of claim 3 , wherein the web application context includes at least one of: a session identifier (sessionID), and a user identity.

5. The method of claim 1 , wherein the threshold is set to a number higher than an expected number of random observations for each pair of URL and query template.

6. The method of claim 5 , wherein the expected number of random observations is determined based on the total number of occurrences for each query template and the total system time that each URL is observed.

7. The method of claim 1 , further comprising adding pairs of SQL templates and URLs of marked entries of the first matrix to normal behavior profiles (NBPs).

8. The method of claim 7 , wherein the NBPs include a SQL NBP and a HTTP NBP.

9. The method of claim 1 , wherein converting the incoming SQL query to the SQL template comprises:

replacing each literal in the SQL query with a place holder;

removing comments in the SQL query; and

removing white-space characters in the SQL query.

10. A computer program product including software instructions stored on a computer-readable medium, adapted to enable a computer to perform a routine for real-time correlating between requests to a web server and requests to a database server, the routing comprising:

identifying correlated pairs of structured query language (SQL) templates and uniform resource locators (URLs);

for each incoming request to the database server binding a web application context in which the request to the database server is made;

wherein identifying the correlated pairs of SQL templates and URLs, further comprises:

creating a first matrix, wherein each row of the first matrix represents a URL and each column represents a SQL template and wherein each entry in the first matrix includes a counter;

extracting the URL from an incoming HTTP request; inserting the URL to an available row in the first matrix; adding the incoming HTTP request to a list of pending HTTP requests for the URL;

converting an incoming SQL query to a SQL template;

inserting the SQL template to an available column in the first matrix; and

incrementing the counter of each entry of a respective URL that has at least one pending HTTP request; and

marking all entries in the first matrix having a counter's value greater than a predefined threshold.

11. The computer program product of claim 10 , wherein requests to web servers are hypertext transfer protocol (HTTP) requests and wherein requests to database server are SQL queries.

12. The computer program product of claim 10 , wherein the threshold is set to a number higher than an expected number of random observations for each pair of URL and query template.

13. The computer program product of claim 10 , wherein the expected number of random observations is determined based on the total number of occurrences for each query template and the total system time that each URL is observed.

14. The computer program product of claim 10 , further comprises adding pairs of SQL templates and URLs of marked entries of the first matrix to normal behavior profiles (NBPs).

15. The computer program product of claim 14 , wherein the NBPs include a SQL NBP and a HTTP NBP.

16. The computer program product of claim 10 , wherein converting the incoming SQL query to the SQL template comprises:

replacing each literal in the SQL query with a place holder;

removing comments in the SQL query; and

removing white-space characters in the SQL query.

17. The computer program product of claim 16 , wherein binding the web application context to the SQL query, further comprises:

receiving a SQL query;

converting the SQL query to a SQL template;

searching in a SQL NBP for URLs that correlate to the SQL template; and

for HTTP request with a correlated URL,

matching between parameters of the HTTP request and literals of the SQL query;

computing a matching score for each HTTP request;

selecting the HTTP request with the highest correlate score; and

binding the web context web application context of the selected HTTP request to the incoming SQL query.

18. The computer program product of claim 17 , wherein the web application context includes at least one of: a session identifier (sessionID), and a user identity.

19. An application level security system for real-time correlating between requests to a web server and requests to a database server, the security system comprises:

a first sensor adapted to capture the requests to the web server;

a second sensor adapted to capture the requests to the database server; and

a secure server adapted to correlate the requests based on inputs from the first sensor and the second sensor, wherein the security system is being further capable of binding a web application context to each request to a database;

wherein requests to web servers are hypertext transfer protocol (HTTP) requests and wherein requests to database server are structured query language (SQL) queries;

wherein correlating the request comprises identifying correlated pairs of SQL templates and uniform resource locators (URLs);

wherein binding the web application to the SQL query, further comprises;

receiving a SQL query from the first sensor;

converting the SQL query to a SQL template;

searching in the SQL NBP for URLs that correlate to the SQL template;

for each HTTP request with a correlated URL:

matching between parameters of the HTTP request and literals of the SQL query;

computing a matching score for each HTTP request;

selecting the HTTP request with the highest correlate score; and

binding the web application context of the selected HTTP request to the incoming SQL query.

20. The system of claim 19 , wherein the first sensor is a SQL sensor.

21. The system of claim 20 , wherein the first sensor includes a SQL normal behavior profiles (NBP).

22. The system of claim 19 , wherein the second sensor is a HTTP sensor.

23. The system of claim 22 , wherein the second sensor includes a HTTP NBP.

24. The system of claim 19 , wherein the web application context includes at least one of a session identifier (ID), a user identity.

25. The system of claim 19 , wherein converting the SQL query to the SQL template comprises:

replacing each literal in the SQL query with a place holder;

removing comments in the SQL query; and

removing white-space characters in the SQL query.