Consider the problem of hardening an existing, database-backed web application, to detect attacks and stop them where possible.
It seems like one plausible approach might be to build an intrusion detection system that has observability at two points: (a) at the web server level (e.g., to observe the page being executed, the request URL, request parameters, the session cookie), and (b) at the database level (e.g., to observe the SQL query that is being executed). I can imagine many opportunities to build an anomaly detector and monitoring system that can detect many attacks. For instance, if in the past SQL queries initiated from the page foo.php
have been SELECT queries, and now you see an UPDATE or DROP command, that might be suspicious. If I see a query that contains a semicolon or a nested subquery, and I've never seen that before from that page, that might be suspicious. And so on. This is the kind of thing that can only be be implemented with visibility into both the web request (e.g., at the web server or front-end level) and the database.
Has anyone looked at this kind of system before? Has anyone built it, and if so, how well does it work? Is there a standard name for this sort of system? (My understanding is that a web application firewall normally has visibility only into the web application but not into the database, so it is different.) Are there existing systems like this available commercially or as open source?