1

Hackers and malware are one step ahead of cybersecurity experts, and every time technology is released to the market, vulnerabilities will be quickly discovered and exploited.

How effective can machine learning technology be particularly in the defense against SQL Injection Attacks (SQLi)? Is it the correct approach to the problem?

closed as primarily opinion-based by Steffen Ullrich, symcbean, Teun Vink, tlng05, ThoriumBR Aug 29 '18 at 16:54

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

3

Machine learning technology is certainly better in scope compared to signature based systems. To your example about SQLi attacks, signatures could look for specific commands/strings within the HTTP payload as means for detection. ML based approach can, instead, define the behavior as process spawned on the db server or unwanted read-only operations etc etc. If there is another novel SQLi attack which escapes the signature (string did not match) but the consequential behavior remains same (process spawned or unwanted read-only operations), then ML approach will come out flying.

Having said that, the ML based approach can only detect a behavior it is trained for. In the above example, if the SQLi attack results in a new reverse tunnel opened to another host, but we did not train the model for this behavior, then the ML approach will not succeed either.


(Answer to the previous question on how signature systems differ from ML based systems)

Yes. Signature checks only for a specific vulnerability and multiple vulnerabilities at best. Machine learning, however, focuses on the behavior of the attack which does not necessarily mean how the exploit was handled, but rather post infection activity etc.

Aside: Developing ML based security systems is my daytime job.

  • what kind of ML are firewall are using -supervised machine learning and unsupervised? – R1- Aug 26 '18 at 20:34
  • How about about false positive ?is it possible to make a bigger problem be denying real user from accessing to website ? – R1- Aug 26 '18 at 20:36
  • 1
    @R1- false positives can be expensive given the context. If the system is looking for threats and blocks user access as a consequence, then false positives will hurt. – sandyp Aug 27 '18 at 19:56

Not the answer you're looking for? Browse other questions tagged or ask your own question.