A Review of Database Attacks
DOI:
https://doi.org/10.14738/tecs.123.17124Keywords:
Database, Database Security, Database Attacks, SQL Injection, Machine Learning, SurveyAbstract
In today’s world, where organizations heavily rely on databases to store and access critical information, database security is a major concern. This paper provides an overview of recent trends and popular threats in database security, as well as an organized literature review of database attacks and related security methods. The primary objectives of this review are to analyze the current state of database attacks, highlight effective defense techniques, and identify research gaps and future directions. The paper categorizes the reviewed literature into various sections, including general database attacks, SQL Injection attacks, Cross-Site Scripting (XSS) attacks, Denial of Service (DoS) attacks, mixed attacks, other types of attacks, and concludes with database encryption techniques. By examining the merits and demerits of existing approaches, this review aims to contribute to a better understanding of database attacks and their related countermeasures. Finally, the findings of this paper can help researchers improve their understanding of the topic and make progress in the study of techniques to address threats to data availability, confidentiality, and integrity.
References
M. Malik and T. Patel, Database security-attacks and control methods. International Journal of Information, 2016. 6(1/2): p. 175–183.
I. Basharat, F. Azam, and A. W. Muzaffar, Database security and encryption: A survey study. International Journal of Computer Applications, 2012. 47(12).
S. Kulkarni and S. Urolagin, Review of attacks on databases and database security techniques. International Journal of Emerging Technology and Advanced Engineering, 2012. 2(11): p. 253–263.
A. Ron, A. Shulman-Peleg, and E. Bronshtein, No sql, no injection? examining nosql security. arXiv (Cornell University), 2015.
S. S. Sarmah, Database security–threats & prevention. International Journal of Computer Trends and Technology, 2019. 67(5): p. 46–53.
S. R. Devara and C. Azad, Improved database security using cryptography with genetic operators. Research Square, 2022.
A. M. Gamundani and L. M. Nekare, A review of new trends in cyber attacks: A zoom into distributed database systems. 2018 IST-Africa Week Conference (IST-Africa) Proceedings, 2018.
Petrosyan, A., Number of data breaches and victims in U.S. 2005-2022 Statistica, 2023. https://www.statista.com/statistics/273550/data-breaches-recorded-in-the-united-states-by-numberof-breaches-and-records-exposed/.
M. Kawalkar and P. Butey, An approach for detecting and preventing sql injection and cross site scripting attacks using query sanitization with regular expression. International Journal of Computer Trends and Technology, 2017. 49(4): p. 237–245.
K. Amirtahmasebi, S. R. Jalalinia, and S. Khadem, A survey of sql injection defense mechanisms. International Conference for Internet Technology and Secured Transactions, 2009. p. 1–8.
I. Jemal, O. Cheikhrouhou, H. Hamam, and A. Mahfoudhi, Sql injection attack detection and prevention techniques using machine learning. International Journal of Applied Engineering Research, 2020. 15(6): p. 569–580. URL: http://dx.doi.org/10.14738/tecs.123.17124 123
L. Ma, D. Zhao, Y. Gao, and C. Zhao, Research on sql injection attack and prevention technology based on web. 2019 International Conference on Computer Network, Electronic and Automation (ICCNEA), 2019. p. 176–179.
Z. S. Alwan and M. F. Younis, Detection and prevention of sql injection attack: a survey. International Journal of Computer Science and Mobile Computing, 2017. 6(8): p. 5–17.
V. Nithya, S. L. Pandian, and C. Malarvizhi, A survey on detection and prevention of cross-site scripting attack. International Journal of Security and Its Applications, 2015. 9(3): p. 139–152.
U. Sarmah, D. Bhattacharyya, and J. K. Kalita, A survey of detection methods for xss attacks. Journal of Network and Computer Applications, 2018. 118: p. 113–143.
C. Lv, L. Zhang, F. Zeng, and J. Zhang, Adaptive random testing for xss vulnerability. 2019 26th Asia-Pacific Software Engineering Conference (APSEC), 2019. p. 63–69.
S. Rathore, P. K. Sharma, and J. H. Park, Xssclassifier: An efficient xss attack detection approach based on machine learning classifier on snss. Journal of Information Processing Systems, 2017. 13(4).
S. Das, D. Venugopal, and S. Shiva, A holistic approach for detecting ddos attacks by using ensemble unsupervised machine learning. Advances in Information and Communication: Proceedings of the 2020 Future of Information and Communication Conference (FICC), Volume 2, 2020. p. 721–738.
M. Idhammad, K. Afdel, and M. Belouch, Semi-supervised machine learning approach for ddos detection. Applied Intelligence, 2018. 48: p. 3193–3208.
E. Bertino, S. Jajodia, and P. Samarati, Database security: Research and practice. Information systems, 1995. 20(7): p. 537–556.
Houben, A.J.H.M., et al., Quantitative analysis of retinal vascular changes in essential and renovascular hypertension. Journal of hypertension, 1995. 13(12).
G. Pernul, Database security. Advances in Computers, 1994. p. 1–72.
T. F. Lunt and E. B. Fernandez, Database security. ACM Sigmod Record, 1990. 19(4): p. 90–97.
F. Ullah, M. Edwards, R. Ramdhany, R. Chitchyan, M. A. Babar, and A. Rashid, Data exfiltration: A review of external attack vectors and countermeasures. Journal of Network and Computer Applications, 2018. 101: p. 18–54.
P. R. McWhirter, K. Kifayat, Q. Shi, and B. Askwith, Sql injection attack classification through the feature extraction of sql query strings using a gap-weighted string subsequence kernel. Journal of information security and applications, 2018. 40: p. 199–216.
A. A. Ashlam, A. Badii, and F. Stahl, A novel approach exploiting machine learning to detect sqli attacks. in 2022 5th International Conference on Advanced Systems and Emergent Technologies (IC ASET), 2022. p. 513–517.
A. A. Ashlam, A. Badii, and F. Stahl, Multi-phase algorithmic framework to prevent sql injection attacks using improved machine learning and deep learning to enhance database security in real-time. 2022 15th International Conference on Security of Information and Networks (SIN), 2022. p. 1–4.
X.-Y. Hou, X.-L. Zhao, M.-J. Wu, R. Ma, and Y.-P. Chen, A dynamic detection technique for xss vulnerabilities. 2018 4th Annual International Conference on Network and Information Systems for Computers (ICNISC), 2018. p. 34–43.
S.-N. Nguyen, V.-Q. Nguyen, J. Choi, and K. Kim, Design and implementation of intrusion detection system using convolutional neural network for dos detection. ICMLSC '18: Proceedings of the 2nd International Conference on Machine Learning and Soft Computing, 2018. pp. 34–38.
A. Patil, A. Laturkar, S. Athawale, R. Takale, and P. Tathawade, A multilevel system to mitigate ddos, brute force and sql injection attack for cloud security. 2017 International Conference on Information, Communication, Instrumentation and Control (ICICIC), 2017. p. 1–7.
L. Iffl ̈ander, A. Dmitrienko, C. Hagen, M. Jobst, and S. Kounev, Hands off my database: Ransomware detection in databases through dynamic analysis of query sequences. arXiv (Cornell University), 2019.
P. Singh and K. Kaur, Database security using encryption. 2015 International Conference on Futuristic Trends on Computational Analysis and Knowledge Management (ABLAZE), 2015. p. 353–358.
Downloads
Published
How to Cite
Issue
Section
License
Copyright (c) 2024 Matteo Bassani, Sikha Bagui
This work is licensed under a Creative Commons Attribution 4.0 International License.
