تحلیل ساختاری و معنایی پرسوجو برای تشخیص حملات تزریق SQL

[1] Web Hacking Incident Database, http://projects.
webappsec.org/Web-Hacking- Incident-Database, 2010.
[2] SANSInstitute, http://www.sans.org/top20/, 2011.
[3] J. Clarke, “SQL Injection Attacks and Defense”,
Syngress Publishing and Elsevier Inc, Burlington, 2009.
[4] W. G. Halfond, J. Viegas and A. Orso,” A Classification
of SQL Injection Attacks and Countermeasures”, College
of Computing Georgia Institute of Technology
IEEE, 2006
[5] Y. Huang, F. Yu, C. Hang, C.H. Tsai, D.T. Lee, S.Y.
Kuo, Securing web application code by static analysis
and runtime protection, in: Proceedings of the 12th International
World Wide Web Conference ACM, 2004, pp.
40–52.
[6] G. Wassermann and Z. Su, “An Analysis Framework for
Security in Web Applications”, In Proceedings of the
FSE Workshop on pecification and Verification of Component-
Based Systems (SAVCBS 2004) , 2004, pp. 70–
78.
[7] F. Valeur, D. Mutz, G. Vigna, “A learning-based approach
to the detection of SQL attacks”, In Proceedings
of the Conference on Detection of Intrusions and Malware
and Vulnerability Assessment, 2005, pp 123–140.
[8] E. Bertino, A. Kamra, and J. P. Early, “Profiling Database
[9] Applications to Detect SQL Injection Attacks,” IEEE
Internation Conference on Performance,Computing, and
Communications (IPCCC), 2007, pp. 449-458.
[10] Y. Kosuga, K. Konoand M. Hanaoka ,“Sania: Syntactic
and Semantic Analysis for Automated Testing
[11] against SQL Injection” ,In proceeding of Computer Security
Applications Conference ,2007, pp.107-117.
[12] S. W. Boyd and A. D. Keromytis,” SQLrand: Preventing
SQL Injection Attacks”, In Proceedings of the 2nd Applied
Cryptography and Network Security (ACNS) Conference,
June 2004 , pp. 292–302.
[13] R. McClure and I. Kr¨uger, “SQL DOM: Compile Time
Checking of Dynamic SQL Statements”, In Proceedings
of the 27th International Conference on Software Engineering
(ICSE 05), 2005, pp.88–
96.
[14] N. Lambert and K. S. Lin,” Use of Query Tokenization
to detect andprevent SQL Injection Attacks,” 3rd IEEE
International Conference on Computer Science and Information
Technology (ICCSIT), July 2010,pp.438-440.
[15] W. G. Halfond and A. Orso , “AMNESIA: Analysis and
Monitoring for NEutralizing SQLInjection Attacks,In
Proceedings of the IEEE and ACM International Conference
on Automated Software Engineering (ASE 2005),
Long Beach, CA, USA, Nov 2005, pp. 7-11.
[16] Z. Suand G.Wassermann, “The Essence of Command
Injection Attacks in Web Applications”, In The 33rd
Annual Symposium on Principles of Programming Languages
(POPL 2006), Jan. 2006, pp.11-13.
[17] G. T. Buehrer, B. W. Weide, and P. A. G. Sivilotti,”
Using Parse Tree Validation to Prevent SQL Injection
Attacks”, In International Workshop on Software Engineering
and Middleware (SEM), 2005.
[18] I. Lee , S. Jeong , S. Yeoc and J. Moond , “A novel
method for SQL injection attack detection based on removing
SQL query attribute values” , Mathematical and
Computer Modeling , 2011.