Systems and methods for improving accuracy in recognizing and neutralizing injection attacks in computer services
Systems and methods for analyzing SQL queries for constraint violations for injection attacks. Tokenizing a SQL query generates a token stream. A parse tree is constructed by iterating over lexical nodes of the token stream. The parse tree is compared to a SQL schema and access configuration for a database in order to analyze the SQL query for constraint violations. Evaluation flaws are also detected. A step-wise, bottom-up approach is employed to walk through the parse tree to detect types and to ascertain from those types whether the condition for SQL execution is static or dynamic. SQL request security engine logic refers to predetermined protective action data and takes the particular type of action specified by the predetermined protective action data. Security is further enhanced by limiting service of requests to requests of one or more specific, accepted data types. Each request is parsed into individual data elements, each an associated key-value pair. If the key is any data element of the request matches a predetermined allowed key, detection and neutralization of any injection attack in the associated value data of the data element is bypassed. A number of patterns that match information to be obscured in logs are established and any matching information is replaced with obscured data. When recording information to the logs, any data whose key is a predetermined masked key is replaced with obscured data.
1. A method for adapting handing of injection attacks in requests for computer services, the method comprising:
receiving request data from a user that represents a service to be provided by a server computer;
parsing the request data into individual data elements, each data element comprising an associated key-value pair, as a parse tree of the user provided requested data;
comparing the parse tree of the user provided requested data to an SQL schema and access configurations to identify an injection attack, wherein the injection attack is identified when a key of the key-value pair does not match a predetermined allowed key;
modifying the data elements in the request data associated with the injection attack such that the request data is modified so as to render the injection attack inoperable.
2. The method of claim 1 wherein the method further comprises processing the request data as modified by taking action specified by the request data without taking any action specified by the injection attack no longer included by the request data as modified.
3. The method of claim 1 wherein determining whether the request data includes an injection attack includes determining that the request includes a cross-site scripting (XSS) attack.
4. The method of claim 1 , further comprising receiving protective action data that is generated in response to physical manipulation of one or more user input devices by a human user.
5. A non-transient computer-readable medium containing programming instructions for causing a computer to perform the method of:
receiving request data from a user that represents a service to be provided by a server computer;
parsing the request data into individual data elements, each data element comprising an associated key-value pair, as a parse tree of the user provided requested data;
comparing the parse tree of the user provided requested data to an SQL schema and access configurations to identify an injection attack, wherein the injection attack is identified when a key of the key-value pair does not match a predetermined allowed key;
modifying the data elements in the request data associated with the injection attack such that the request data is modified so as to render the injection attack inoperable.
6. The computer readable medium of claim 5 for further causing a computer to perform the method of processing the request data as modified by taking action specified by the request data without taking any action specified by the injection attack no longer included by the request data as modified.
7. The computer readable medium of claim 5 for further causing a computer to perform the method of determining whether the request data includes an injection attack to determine if the request includes a cross-site scripting (XSS) attack.
8. The computer readable medium of claim 5 for further causing a computer to perform the method of receiving protective action data that is generated in response to physical manipulation of one or more user input devices by a human user.
9. A method for adapting handing of injection attacks in requests for computer services, the method comprising:
receiving request data from a user that represents a service to be provided by a server computer;
parsing the request data into individual data elements, each data element comprising an associated key-value pair, as a parse tree of the user provided requested data;
comparing the parse tree of the user provided requested data to an SQL schema and access configurations to identify an injection attack, wherein the injection attack is identified when a key of the key-value pair does not match a predetermined allowed key; and
refusing the request that includes an injection attack, and refusing to process the request data.