Abstract: A novel approach to detect injection attacks was presented by identifying characteristics of injection attacks and using a neural network model to determine the likelihood that a given query is malicious. Based on the recognition of SQL character injection attack, the analysis model comes into being used to determine whether to inject SQL statements of model by using a large number of known data and the neural network algorithm. After that, based on the neural network model presented, the user input SQL statement can be directly analyzed and processed. This approach is implemented in a proxy that locates between a Web application and a database and prevents suspected malicious queries from being executed. This requires no modification of existing application code and is capable of identifying unknown attacks. Experimental results show that the model can effectively improve the accuracy and efficiency of the detection.

Key words: SQL injection, malicious query, Web application, neural network