Preventing database schema extraction by error message handling

doi:10.1016/j.is.2015.09.010

Return

Preventing database schema extraction by error message handling

2016-03-01

PRE

Sepideh Naghdi *

Morteza Amini

DOI：10.1016/j.is.2015.09.010

Original

Original request for help

Save

Abstract

En 中文

Nowadays, a large volume of an organization's sensitive data is stored in databases making them attractive to attackers. The useful information attackers try to obtain in the preliminary steps, is the database structure or schema. One of the popular approaches to infer and extract the schema of a database is to analyze the returned error messages from its DBMS. In this paper, we propose a framework to handle and modify the error messages automatically in order to prevent schema revealing. To this aim, after identifying and introducing an appropriate set of categories of error messages, each error message that is returned from a DBMS is placed in a proper category. According to the policy specified for each category, corresponding rules are applied for removing/modifying/obfuscating the sensitive data in the error messages of that category before submitting them to the application. The general way proposed to determine the category of an error message is employing the keyword based categorization approach, which is 95% accurate for Microsoft SQL Server 2012. (C) 2015 Elsevier Ltd. All rights reserved.

Keywords:

Error handling

Database security

Database schema extraction

Error message modification

AI Summary

Key information extracted from the uploaded paper, including a brief overview, abstract, background, key highlights, visual analysis, and future outlook.