| Summary: | In this work, performance of two existing SQL injection detection methods is compared and analysed together. The first existing method uses removal of SQL query attribute values method, and the other one uses database profiling technique in detecting malicious SQL query in SQL injection attacks. Both detection method algorithms are implemented and tested using SQL query log generated from DVWA and Mutillidae web applications. Analysis and evaluation from results of the experiment showed that detection method based on the considered database profiling method is found to be much flexible and more effective. Nevertheless, it was found that the former method still has some room of improvement that could be done. Therefore, improvement on the former method is proposed that increase the effectiveness of the method to distinguish non-malicious query and the malicious query during the SQL injection detection process. © 2021 IEEE.
|
|---|