Machine learning detection of database injection attacks

A computing system comprising:

• memory;
• one or more processing units coupled to the memory;
• and
• one or more non-transitory computer readable storage media storing instructions that, when executed, cause the computing system to perform operations comprising:
• receiving user input for a first dynamic query, the user input comprising one or more characters;
• escaping the user input to provide escaped user input, the escaping comprising adding at least one character to the one or more characters to indicate that at least one character of the one or more characters corresponds to user input, the escaped user input comprising the one or more characters of the user input and the at least one character;
• forming a first version of the first dynamic query by adding the user input to a dynamic query language statement comprising a plurality of query language operators and executable by a database system to provide first query results;
• forming a second version of the first dynamic query by adding the escaped user input to the dynamic query language statement, the second version of the first dynamic query comprising the plurality of query language operators and executable by the database system to provide second query results, wherein the second query results are the first query results or are different than the first query results;
• parsing and tokenizing the first version of the first dynamic query to obtain a first set of tokens;
• parsing and tokenizing the second version of the first dynamic query to obtain a second set of tokens;
• comparing the first and second set of tokens;
• determining whether the first and second sets of tokens are equal based on the comparing;
• generating a training label based on the determining, the training label indicating whether the user input may be associated with an attempted security violation;
• and
• training a machine learning component with the user input and the training label to, at least in part, provide a trained classifier, wherein the trained classifier is usable to determine whether a second dynamic query may be associated with an attempted security violation.

One or more non-transitory computer-readable storage media comprising:

• computer-executable instructions that, when executed by a computing system comprising at least one hardware processor and at least one memory coupled to the at least one hardware processor, cause the computing system to receive user input for a first dynamic query, the user input comprising one or more characters;
• computer-executable instructions that, when executed by the computing system, cause the computing system to escape the user input to provide escaped user input, the escaping comprising adding at least one character to the one or more characters to indicate that at least one character of the one or more characters corresponds to user input, the escaped user input comprising the one or more characters of the user input and the at least one character;
• computer-executable instructions that, when executed by the computing system, cause the computing system to form a first version of the first dynamic query by adding the user input to a dynamic query language statement comprising a plurality of query language operators and executable by a database system to provide first query results;
• computer-executable instructions that, when executed by the computing system, cause the computing system to form a second version of the first dynamic query by adding the escaped user input to the dynamic query language statement, the second version of the first dynamic query comprising the plurality of query language operators and executable by the database system to provide second query results, wherein the second query results are the first query results or are different than the first query results;
• computer-executable instructions that, when executed by the computing system, cause the computing system to parse and tokenize the first version of the first dynamic query to obtain a first set of tokens;
• computer-executable instructions that, when executed by the computing system, cause the computing system to parse and tokenize the second version of the first dynamic query to obtain a second set of tokens;
• computer-executable instructions that, when executed by the computing system, cause the computing system to compare the first and second set of tokens;
• computer-executable instructions that, when executed by the computing system, cause the computing system to determine whether the first and second sets of tokens are equal based on the comparing;
• computer-executable instructions that, when executed by the computing system, cause the computing system to generate a training label based on the determining, the training label indicating whether the user input may be associated with an attempted security violation;
• and
• computer-executable instructions that, when executed by the computing system, cause the computing system to train a machine learning component with the user input and the training label to, at least in part, provide a trained classifier, wherein the trained classifier is usable to determine whether a second dynamic query may be associated with an attempted security violation.