Skip to main content
SpringerLink
Log in

SiC: An Agent Based Architecture for Preventing and Detecting Attacks to Ubiquitous Databases

  • Chapter
  • First Online:
Pervasive Computing

Part of the book series: Computer Communications and Networks ((CCN))

  • 609 Accesses

Abstract

One of the main attacks to ubiquitous databases is the structure query language (SQL) injection attack, which causes severe damages both in the commercial aspect and in the user’s confidence. This chapter proposes the SiC architecture as a solution to the SQL injection attack problem. This is a hierarchical distributed multiagent architecture, which involves an entirely new approach with respect to existing architectures for the prevention and detection of SQL injections. SiC incorporates a kind of intelligent agent, which integrates a case-based reasoning system. This agent, which is the core of the architecture, allows the application of detection techniques based on anomalies as well as those based on patterns, providing a great degree of autonomy, flexibility, robustness and dynamic scalability. The characteristics of the multiagent system allow an architecture to detect attacks from different types of devices, regardless of the physical location. The architecture has been tested on a medical database, guaranteeing safe access from various devices such as PDAs and notebook computers.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 129.00
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 169.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info
Hardcover Book
USD 169.99
Price excludes VAT (USA)
  • Durable hardcover edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

References

  1. Aamodt A, Plaza E (1994) Case-based reasoning: Foundational issues, methodological variations, and system approaches. AI Communications. Vol. 7, pp. 39–59.

    Google Scholar 

  2. Abraham A, Jain R, Thomas J, Han SY (2007) D-SCIDS: Distributed soft computing intrusion detection system. Journal of Network and Computer Applications. Vol. 30(1), pp. 81–98.

    Article  Google Scholar 

  3. Agrawal R, Kiernan J, Srikant R, Xu Y (2002) Hippocratic databases. In: 28th International Conference on Very Large Data Bases. Hong Kong, pp. 143–154.

    Google Scholar 

  4. Anley C (2002) Advanced SQL Injection in SQL Server Applications. NGS Software http://www.nextgenss.com/papers/advanced sql injection.pdf. Accessed 10 April 2007.

  5. Application Security Inc (2005) Protecting the Crown Jewels. http://www.appsecinc.com/cgi-bin/search.pl?Terms=crown . Accessed 12 April 2008.

  6. Application Security Inc (2007) Introduction to Database and Application Worms. http://www.appsecinc.com/presentations/Database_Application_Worms.pdf . Accessed 10 April 2008.

  7. Bajo J, De Luis A, González A, Saavedra A, Corchado JM (2006) A shopping mall multiagent system: Ambient intelligence in practice. In: 2nd International Workshop on Ubiquitous Computing & Ambient Intelligence, pp. 115–125.

    Google Scholar 

  8. Bellifemine F, Poggi A, Rimassa G (1999) Jade: A FIPA-compliant agent framework. In: Proceedings of PAAM-1999, pp. 97–108.

    Google Scholar 

  9. Bergenti F, Poggi A (2001) LEAP: A FIPA platform for handheld and mobile devices. In: Proceedings of the ATAL 2001 Conference. Seattle.

    Google Scholar 

  10. Bertino E, Sandhu R (2005) Database security-concepts, approaches, and challenges. In: IEEE Computer Society, Los Alamitos. Vol. 2, pp. 2–9.

    Google Scholar 

  11. Boyd SW, Keromytis AD (2004) SQLrand: Preventing SQL injection attacks. In: Applied Cryptography and Network Security. Vol. 3089, pp. 292–302.

    Article  Google Scholar 

  12. Bratman ME (1987) Intention, Plans, and Practical Reason. Harvard University Press, Cambridge, MA.

    Google Scholar 

  13. Breach Security, Inc (2007) The Web Hacking Incidents Database. http://www.breach.com/ . Accessed 02 April 2008.

  14. Buehrer G, Weide BW, Sivilotti PAG (2005) Using parse tree validation to prevent SQL injection attacks. In: 5th International Workshop on Software Engineering and Middleware. ACM, New York, pp. 106–113.

    Google Scholar 

  15. Carrascosa C, Bajo J, Julian V, Corchado JM, Botti V (2008) Hybrid multi-agent architecture as a real-time problem-solving model. Expert Systems with Applications. Vol. 34(1), pp. 2–17.

    Article  Google Scholar 

  16. Christensen AS, Moller A, Schwartzbach MI (2003) Precise analysis of string expressions. In: 10th International Static Analysis Symposium. Springer, pp. 1–18.

    Google Scholar 

  17. Cook R, Rai S (2005) Safe query objects: Statically typed objects as remotely executable queries. In: 27th International Conference on Software Engineering. ACM, St. Louis, pp. 97–106.

    Google Scholar 

  18. Corchado JM, Bajo J, Abraham A (2008) GerAmi: Improving healthcare delivery in geriatric residences. IEEE Intelligent Systems. Vol. 23, pp. 19–25.

    Google Scholar 

  19. Corchado JM, Bajo J, De Paz Y, Tapia D (2008) Intelligent environment for monitoring Alzheimer patients, agent technology for health care. In: Decision Support Systems. Vol. 34(2), pp. 382–396.

    Article  Google Scholar 

  20. Foundation for Intelligent Physical Agents. http://www.fipa.org . Accessed 15 August 2007.

  21. Georgeff MP, Lansky AL (1987) Reactive reasoning and planning. In: American Association of Artificial Intelligence. Seattle, pp. 677–682.

    Google Scholar 

  22. Glez-Bedia M, Corchado JM (2002) A planning strategy based on variational calculus for deliberative agents. Computing and Information Systems Journal. Vol. 10(1), pp. 2–14.

    Google Scholar 

  23. Gould C, Su Z, Devanbu P (2004) JDBC Checker: A static analysis tool for SQL/JDBC applications. In: 26th International Conference on Software Engineering. IEEE Computer Society, Washington, DC, pp. 697–698.

    Google Scholar 

  24. Halfond W, Orso A (2005) AMNESIA: Analysis and monitoring for neutralizing SQL-injection attacks. In: 20th IEEE/ACM International Conference on Automated Software Engineering. ACM, New York, pp. 174–183.

    Google Scholar 

  25. Halfond WG, Viegas J, Orso A (2006) A classification of SQL-injection attacks and countermeasures. In: IEEE International Symposium on Secure Software Engineering. Arlington.

    Google Scholar 

  26. Hayat Z, Reeve J, Boutle C (2007) Ubiquitous security for ubiquitous computing. In: Elsevier Advanced Technology Publications, Oxford, pp. 172–178.

    Google Scholar 

  27. Huang Y, Huang S, Lin T, Tsai C (2003) Web application security assessment by fault injection and behavior monitoring. In: 12th International Conference on World Wide Web. ACM, New York, pp. 148–159.

    Google Scholar 

  28. Kosuga Y, Kono K, Hanaoka M, Hishiyama M, Takahama Y (2007) Sania: Syntactic and semantic analysis for automated testing against SQL injection. In: 23rd Annual Computer Security Applications Conference. IEEE Computer Society, pp. 107–117.

    Google Scholar 

  29. Kruegel C, Vigna G (2003) Anomaly detection of web-based attacks. In: 10th ACM Conference on Computer and Communications Security. ACM, New York, pp. 251–261.

    Google Scholar 

  30. Laza R, Pavón R, Corchado JM (2003) A reasoning model for CBR_BDI agents using an adaptable fuzzy inference system. In: 10th Conference of the Spanish Association for Artificial Intelligence. Springer. Vol. 3040, pp. 96–106.

    Google Scholar 

  31. Litchfield D (2005) Data Mining with SQL Injection and Inference, NGS Software. http://www.ngssoftware.com/research/papers/sqlinference.pdf . Accessed 10 April 2007.

  32. Litchfield D, Anley C, Heasman J, Grindlay B (2005) The Database Hacker’s Handbook: Defending Database Servers. Wiley, New York.

    Google Scholar 

  33. Maurer U (2004) The role of cryptography in database security. In: ACM SIGMOD International Conference on Management of Data. ACM, New York, pp. 5–10.

    Google Scholar 

  34. McClure RA, Krger IH (2005) SQL DOM: Compile time checking of dynamic SQL statements. In: 27th International Conference on Software Engineering. ACM, New York, pp. 88–96.

    Google Scholar 

  35. Mukkamala S, Sung AH, Abraham A (2005) Intrusion detection using an ensemble of intelligent paradigms. Journal of Network and Computer Applications. Vol. 28(2), pp. 167–182.

    Article  Google Scholar 

  36. Pervasive Software Inc (2003) Implementing Security Best Practices for HIPAA with Pervasive.SQL. http://www.msmiami.com/custom/downloads/Pervasive_HIPAASecurity_Paper.pdf . Accessed 10 April 2008.

  37. Pinzón C, De Paz Y, Cano R (2008) Classification agent-based techniques for detecting intrusions in databases. In: 3rd International Workshop on Hybrid Artificial Intelligence Systems.

    Google Scholar 

  38. Ramasubramanian P, Kannan A (2004) Quickprop neural network ensemble forecasting a database intrusion prediction system. Neural Information Processing. Vol. 5, pp. 847–852.

    Google Scholar 

  39. Rescorla E, Schiffman A (1999) The Secure HyperText Transfer Protocol RFC Editor, United States. http://www.rfc-editor.org/rfc/rfc2660.txt . Accessed 10 January 2008.

  40. Rieback MR, Crispo B, Tanenbaum AS (2006) Is your cat infected with a computer virus?. In: Fourth Annual IEEE International Conference on Pervasive Computing and Communications. IEEE Computer Society, Washington, DC, pp. 169–179.

    Google Scholar 

  41. Rieback MR, Crispo B, Tanenbaum AS (2006) RFID Malware: Truth vs. Myth. IEEE Security and Privacy. Vol. 4(4), pp. 70–72.

    Article  Google Scholar 

  42. Rieback MR, Simpson PN, Crispo B, Tanenbaum AS (2006) RFID malware: Design principles and examples. Pervasive and Mobile Computing. Vol. 2(4), pp. 405–426.

    Article  Google Scholar 

  43. Rietta F (2006) Application layer intrusion detection for SQL injection. In: 44th Annual Southeast Regional Conference. ACM, New York, pp. 531–536.

    Google Scholar 

  44. Skaruz J, Seredynski F (2007) Recurrent neural networks towards detection of SQL attacks. In: 21st International Parallel and Distributed Processing Symposium. IEEE International, pp. 1–8.

    Google Scholar 

  45. Thuraisingham B (2002) Data mining, national security, privacy and civil liberties. ACM, New York. Vol. 4(2), pp. 1–5. http://portal.acm.org/citation.cfm?id=772862.772863 .

  46. Valeur F, Mutz D, Vigna G (2005) A learning-based approach to the detection of SQL attacks. In: Proceedings of the Conference on Detection of Intrusions and Malware and Vulnerability Assessment. Vienna, Austria, pp. 123–140.

    Google Scholar 

  47. Wassermann G, Su Z (2004) An analysis framework for security in web applications. In: FSE Workshop on Specification and Verification of Component-Based Systems, pp. 70–78.

    Google Scholar 

  48. Wooldridge M, Jennings NR (1995) Intelligent agents: Theory and practice. Knowledge Engineering Review. Vol. 10(2), pp. 115–152.

    Article  Google Scholar 

  49. Woolridge M, Wooldridge MJ (2002) Introduction to Multiagent Systems. Wiley, New York.

    Google Scholar 

  50. Wu J, Wang C, Wang J, Chen S (2006) Dynamic hierarchical distributed intrusion detection system based on multi-agent system. In: EEE/WIC/ACM International Conference on Web Intelligence and Intelligent Agent Technology. IEEE International, pp. 89–93.

    Google Scholar 

  51. Xiong L, Chitti S, Liu L (2007) Preserving data privacy in outsourcing data aggregation services. In: ACM Transactions on Internet Technology. New York, Vol. 7(3), pp. 17.

    Google Scholar 

  52. Zaidenberg S, Reignier P, Crowley, JL (2007) An architecture for ubiquitous applications. In: 1st International Joint Workshop on Wireless Ubiquitous Computing. Vol. 1, pp. 86–95.

    Google Scholar 

Download references

Acknowledgments

This development has been partially supported by the Spanish Ministry of Science project TIN2006-14630-C03-03.

Author information

Authors and Affiliations

  1. Norwegian Center of Excellence, Center of Excellence for Quantifiable Quality of Service, Norwegian University of Science and Technology, O.S. Bragstads Plass 2E, N-7491, Trondheim, Norway

    Cristian Pinzón, Yanira De Paz, Javier Bajo, Ajith Abraham & Juan M. Corchado

Authors
  1. Cristian Pinzón
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Yanira De Paz
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Javier Bajo
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Ajith Abraham
    View author publications

    You can also search for this author in PubMed Google Scholar

  5. Juan M. Corchado
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Ajith Abraham .

Editor information

Editors and Affiliations

  1. Fac. Computers & Information, Cairo University, Ahmed Zewal Street 5, Giza, 12613, Egypt

    Aboul-Ella Hassanien

  2. School of Engineering &, Deakin University, Geelong, 3217, Australia

    Jemal H. Abawajy

  3. Technology, Norwegian University of Science &, O.S. Bragstads plass 2E, Trondheim, 7491, Norway

    Ajith Abraham

  4. Dept. Computer Science, University of Essex, Wivenhoe Park, Colchester, CO4 3SQ, United Kingdom

    Hani Hagras

Rights and permissions

Reprints and permissions

Copyright information

© 2009 Springer-Verlag London Limited

About this chapter

Cite this chapter

Pinzón, C., De Paz, Y., Bajo, J., Abraham, A., Corchado, J.M. (2009). SiC: An Agent Based Architecture for Preventing and Detecting Attacks to Ubiquitous Databases. In: Hassanien, AE., Abawajy, J., Abraham, A., Hagras, H. (eds) Pervasive Computing. Computer Communications and Networks. Springer, London. https://doi.org/10.1007/978-1-84882-599-4_11

Download citation

  • DOI: https://doi.org/10.1007/978-1-84882-599-4_11

  • Published:

  • Publisher Name: Springer, London

  • Print ISBN: 978-1-84882-598-7

  • Online ISBN: 978-1-84882-599-4

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation