Analyzing SQL Injection Statements Using Common Substructure of Parse Tree

This paper proposes a SQL injection detection method by analyzing substructure of SQL statement. The proposed method consists of 2 parts, Automated Common Substructure Extracting (ACSE) and Parse Tree Substructure Matching (PTSM). ACSE attempts to extract the duplicated substructures that appear in parse trees of SQL injection statements. PTSM uses the extracted parse tree from ACSE for identifying malicious portions in user's input statements. It also calculates the similarity between the common substructure and input statements. Experimental results show that the proposed method gains an accuracy greater than 90 percent.