Over 20 Years of SQL Injection Attacks in the Wild - Time to Refine and ...
summary
Claims that CDN logs classified as SQL injection attacks plus NLP and data‑mining produce usable rules and insights: a five-step process cleans and tokenizes payloads, builds matrices, computes Jaccard similarity, and performs hierarchical clustering on 500,000 unique payloads. Results surface recurring keyword clusters, column/table names, and exploitable campaigns, enable replacing some regex with simple patterns, and yield rule reordering that measurably improves detection and signature performance from real CDN data.
AI-written summary · about
chapters (12)
- 0:00Intro
- 1:20Background
- 3:29Theory
- 5:05Denial of Service
- 6:56New Skills
- 8:11Five Step Process
- 9:44Step 1 Collecting Data
- 11:54Step 2 Choosing Keywords
- 12:46Step 3 The Matrix
- 14:19Step 4 The Relationship
- 15:45Step 5 Clustering
- 16:40Step 6 Real World Example
related talks
26mAll Your Queries Are Belong to Us: The Power of File-Injection Attacks...
22mSecure Your Code — Injections and Logging
23mBye-Bye False Positives: Using AI to Improve Detection
30mTrawling for IOCs: Catching C2 in a Sea of Data
23m{JS-ON: Security-OFF}: Abusing JSON-Based SQL Queries
54mTaking on the King: Killing Injection Vulnerabilities
23mWebsite-Targeted False Content Injection by Network Operators
37mCrush Cred Stuffing: A Method for Neutralizing Credential Stuffing Attacks