With the advancement in big data, NoSQL databases are enjoying ever-growing popularity. The increasing use of this technology in large applications also brings security concerns to the fore. Historically, SQL injection has been one of the major security threats over the years. Recent studies reveal that NoSQL databases also have become vulnerable to injections. However, NoSQL security is yet to receive the attention it deserves from the industry or academia. In this work, we develop a tool for detecting NoSQL injections using supervised learning. To the best of our knowledge, our developed training dataset on NoSQL injection is the first of its kind. We manually design important features and apply various supervised learning algorithms. Our tool has achieved 0.93 F2-score as established by 10-fold cross-validation. We also apply our tool to a NoSQL injection generating tool, NoSQLMap and find that our tool outperforms Sqreen, the only available NoSQL injection detection tool, by 36.25% in terms of detection rate. The proposed technique is also shown to be database-agnostic achieving similar performance with injection on MongoDB and CouchDB databases.

Automatic Detection of NoSQL Injection Using Supervised Learning

NoSQL databases were created for the purpose of manipulating large amounts of data in real time. However, at the beginning, security was not important for their developers. The popularity of SQL generated the false belief that NoSQL databases were immune to injection attacks. As a consequence, NoSQL databases were not protected and are vulnerable to injection attacks. In addition, databases with NoSQL queries are not available for experimentation. Therefore, this paper presents a new method for the construction of a NoSQL query database, based on JSON structure. Six classification algorithms were evaluated to identify the injection attacks: SVM, Decision Tree, Random Forest, K-NN, Neural Network and Multilayer Perceptron, obtaining an accuracy with the last two algorithms of 97.6%.

Automatic Detection of Injection Attacks by Machine Learning in NoSQL Databases

This paper presents a new method to protect the applications against NoSQL injection. NoSQL-Injection Attacks are a class of attacks that many of these systems are highly vulnerable to, and there is no known fool-proof defense against various attacks. Despite all vulnerabilities, two factor authentications remain the safest way to protect user accounts in traditional web apps. Two bypasses of factor authentication can occur from time to time, with various techniques involved in those attacks; the only way to do this is to maintain an iteration of one's approach to two authentication factor tests

Hong Ma

Papers

A Parse Tree-Based NoSQL Injection Attacks Detection Mechanism.