تشخیص و پیشگیری از حملات تزریق SQL در زمان اجرا با استفاده از طبقه‌بندی درخت تصمیم

   [1]      W. G. Halfond and A. Orso, “AMNESIA: analysis and monitoring for NEutralizing SQL-injection attacks,” in Proceedings of the 20th IEEE/ACM international Conference on Automated software engineering, 2005, pp. 174-183.##

   [2]      S. Kumar, R. Mahajan, N. Kumar, and S. K. Khatri, “A study on web application security and detecting security vulnerabilities,” in 2017 6th International Conference on Reliability, Infocom Technologies and Optimization (Trends and Future Directions)(ICRITO), 2017, pp. 451-455.##

   [3]      OWASP Top 10 Application Security Risks – 2017. Available: https://www.owasp.org/index.php/Top_10_2017-Top_10##

   [4]      W. G. Halfond and A. Orso, “Preventing SQL injection attacks using AMNESIA,” in Proceedings of the 28th international conference on Software engineering, pp. 795-798, 2006.##

   [5]      K. Beaver, Hacking for dummies: John Wiley & Sons, 2007.##

   [6]      M. T. Simpson, K. Backman, and J. Corley,    Hands-on ethical hacking and network defense: Cengage Learning, 2010.##

   [7]      W. G. Halfond, J. Viegas, and A. Orso, “A classification of SQL-injection attacks and countermeasures,” in Proceedings of the IEEE International Symposium on Secure Software Engineering, pp. 13-15, 2006.##

   [8]      E. R. Indrani Balasundaram, “An approach to detect and prevent SQL injection attacks in database using web service,” IJCSNS International Journal of Computer Science and Network Security, vol. 11, pp. 95-100, 2011.##

   [9]      R. Yeole, S. Ninawe, P. Dhore, and P. Tembhare, “A Study on Detection and Prevention of SQL Injection Attack,” 2017.##

[10]      U. Agarwal, M. Saxena, and K. S. Rana, “A Survey of SQL Injection Attacks,” International Journal of Advanced Research in Computer Science and Software Engineering, vol. 5, pp. 286-289, 2015.##

[11]      A. Tajpour, M. Z. Heydari, M. Masrom, and S. Ibrahim, “SQL injection detection and prevention tools assessment,” in Computer Science and Information Technology (ICCSIT), 2010 3rd IEEE International Conference on, pp. 518-522, 2010.##

[12]      C. Gould, Z. Su and P. Devanbu, “JDBC checker: A static analysis tool for SQL/JDBC applications,” in Proceedings of the 26th International Conference on Software Engineering, pp. 697-698, 2004.##

[13]      S. Madan and S. Madan, “Shielding against sql injection attacks using admire model,” in Computational Intelligence, Communication Systems and Networks, 2009. CICSYN'09. First International Conference on, pp. 314-320, 2009,##

[14]      B. Indrani and E. Ramaraj, “X–LOG Authentication Techniqe to Prevent SQL Injection Attacks,” International Journal of Information Technology and Knowledge Management, vol. 4, pp. 323-328, 2011.##

[15]      G. Buehrer, B. W. Weide, and P. A. Sivilotti, “Using parse tree validation to prevent SQL injection attacks,” in Proceedings of the 5th international workshop on Software engineering and middleware, pp. 106-113, 2005.##

[16]      Z. Su and G. Wassermann, “The essence of command injection attacks in web applications,” in ACM SIGPLAN Notices, pp. 372-382, 2006.##

[17]      A. Sadeghian, M. Zamani, and A. A. Manaf, “SQL injection vulnerability general patch using header sanitization,” in Computer, Communications and Control Technology (I4CT), 2014 International Conference on, pp. 239-242, 2014.##

[18]      A. Pramod, A. Ghosh, A. Mohan, M. Shrivastava, and R. Shettar, “SQLI detection system for a safer web application,” in Advance Computing Conference (IACC), 2015 IEEE International, pp. 237-240, 2015.##

[19]      A. Makiou, Y. Begriche, and A. Serhrouchni, “Improving Web Application Firewalls to detect advanced SQL injection attacks,” in Information Assurance and Security (IAS), 2014 10th International Conference on, pp. 35-40, 2014.##

[20]      Y.-W. Huang, F. Yu, C. Hang, C.-H. Tsai, D.-T. Lee, and S.-Y. Kuo, “Securing web application code by static analysis and runtime protection,” in Proceedings of the 13th international conference on World Wide Web, pp. 40-52, 2004.##

[21]      A. S. Christensen, A. Møller, and M. I. Schwartzbach, “Precise analysis of string expressions,” in International Static Analysis Symposium, pp. 1-18, 2003.##

[22]      D. Sharma, K. Kale, C. Date, and D. Bhave, “Using AMNESIA to secure web applications and database against SQL injection attack,” 2017.##

[23]      K. Kemalis and T. Tzouramanis, “SQL-IDS: a specification-based approach for SQL-injection detection,” in Proceedings of the 2008 ACM symposium on Applied computing, pp. 2153-2158, 2008.##

[24]      V. Kodaganallur, “Incorporating language processing into java applications: A javacc tutorial,” IEEE software, vol. 21, pp. 70-77, 2004.##

[25]      M. S. Lam, M. Martin, B. Livshits, and J. Whaley, “Securing web applications with static and dynamic information flow tracking,” in Proceedings of the 2008 ACM SIGPLAN symposium on Partial evaluation and semantics-based program manipulation, pp. 3-12, 2008.##

[26]      V. B. Livshits and M. S. Lam, “Finding Security Vulnerabilities in Java Applications with Static Analysis,” in USENIX Security Symposium, pp.   18-18, 2005.##

[27]      Y. V. N. Manikanta and A. Sardana, “Protecting web applications from SQL injection attacks by using framework and database firewall,” in Proceedings of the International Conference on Advances in Computing, Communications and Informatics, pp. 609-613, 2012.##

[28]      I. Lee, S. Jeong, S. Yeo, and J. Moon, “A novel method for SQL injection attack detection based on removing SQL query attribute values,” Mathematical and Computer Modelling, vol. 55, pp. 58-68 ,2012.##

[29]      B. Tajalipour and A. Safaie, “Structural  and semantic  analysis of query  to detect  SQL injection attacks,” Journal of Electronical & Cyber Defence, vol. 2, pp. 83-97, 2014. (In Persian)##

[30]      M. Alkhalaf, A. Aydin, and T. Bultan, “Semantic differential repair for input validation and sanitization,” in Proceedings of the 2014 International Symposium on Software Testing and Analysis, pp. 225-236, 2014.##

[31]      K. Frajták, M. Bureš, and I. Jelínek, “Reducing user input validation code in web applications using Pex extension,” in Proceedings of the 15th International Conference on Computer Systems and Technologies, pp. 302-308, 2014.##

[32]      X. Li and Y. Xue, “A survey on server-side approaches to securing web applications,” ACM Computing Surveys (CSUR), vol .46, p. 54, 2014.##

[33]      S. Cho, G. Kim, S.-j. Cho, J. Choi, M. Park, and S. Han, “Runtime input validation for Java web applications using static bytecode instrumentation,” in Proceedings of the International Conference on Research in Adaptive and Convergent Systems, pp. 148-152, 2016.##

[34]      I. Medeiros, N. F. Neves, and M. Correia, “Automatic detection and correction of web application vulnerabilities using data mining to predict false positives,” in Proceedings of the 23rd internati