SQLiDDS: SQL Injection Detection using Document Similarity Measure Debabrata Kar a,* , Suvasini Panigrahi b and Srikanth Sundararajan c,** a Department of Computer Science and Engineering Silicon Institute of Technology, Bhubaneswar 751024, India E-mail: debabrata.kar@silicon.ac.in b Department of Computer Science and Engineering VSS University of Technology, Burla, Sambalpur, India E-mail: spanigrahi_cse@vssut.ac.in and c Indian Institute of Technology, Bhubaneswar, India E-mail: sundararajan.srikanth@gmail.com Abstract. SQL injection attack has been a major security threat to web applications for over a decade. Now a days, attackers use automated tools to discover vulnerable websites from search engines and launch attacks on multiple websites simultaneously. Being extremely heterogeneous in nature, accurate run-time detection of SQL injection attacks, particularly those previously unseen, is still a challenge using regular-expression or parse-tree matching techniques suggested in the literature. In this paper, we present a novel approach for real-time detection of SQL injection attacks by applying document similarity measure on run-time queries after normalizing them into sentence-like form. The proposed approach acts as a database firewall and can protect multiple web applications using the database server. With additional inputs from human expert, the system can also become more robust over time. We implemented the approach in a tool named SQLiDDS and the experimental results are very encouraging. The approach can effectively detect all types of SQL injection attacks and previously unseen attacks with substantial accuracy yet negligible impact on overall performance of web applications. The tool was built with PHP and tested on web applications built with PHP and MySQL, but it can be adapted to other platforms with minimal changes. Keywords: sql injection detection, query normalization, document similarity, database firewall, phrase similarity 1. Introduction Web applications are exposed to different types of security threats like Denial of Service (DoS), Structured Query Language (SQL) injection, Cross Site Scripting (XSS), etc. Among these, SQL Injection attack is predominantly used against web databases. The Open Web Application Security Project (OWASP) ranks it on top among the Top-10 security threats [38]. According to TrustWave [44] Global Security Report, SQL injection was the number one attack method for four consecutive years. Attacking a website * Corresponding author. ** Currently at Helion Advisors, Bangalore, India.