Recurrent neural networks in the context of SQL attacks

Abstract

In the paper we present a new approach based on application of neural networks to detect SQLattacks. SQL attacks are those attacks that take advantage of using SQL statements to beperformed. The problem of detection of this class of attacks is transformed to time seriesprediction problem. SQL queries are used as a source of events in a protected environment. Todifferentiate between normal SQL queries and those sent by an attacker, we divide SQL statementsinto tokens and pass them to our detection system, which predicts the next token, taking intoaccount previously seen tokens. In the learning phase tokens are passed to recurrent neuralnetwork (RNN) trained by backpropagation through time (BPTT) algorithm. Teaching data areshifted by one token forward in time with relation to input. The purpose of the testing phase is topredict the next token in the sequence. All experiments were conducted on Jordan and Elmannetworks using data gathered from PHP Nuke portal. The experimental results show that theJordan network outperforms the Elman network predicting correctly queries of the length up toten.