Desarrollo de un prototipo de sistema que permita la identificación y predicción de ataques a sistemas de bases de datos utilizando técnicas de minería de datos.

Abstract

In the Computer Security Incident Response Center of the National Polytechnic School (CSIRTEPN) vulnerability has been detected in the database servers and evidence of information leakage, mainly with SQL (Structured query language) code injection attacks. This data mining project was developed using the CRISP-DM methodology, fulfilling the objective of detecting and preventing SQL injection attacks by analyzing transaction records (logs). The anomaly detection model was carried out using the clustering algorithm KNN (Closest Neighbors Algorithm). For the groups with anomalies, the query text was analyzed to identify sentences presenting attack traces. An evaluation of the performance of the model was carried out, measuring its accuracy, precision and sensitivity when used in a set of 50 attacks, obtaining 80% effectiveness in the detection of SQL code injection. For the data visualization system, an interface was implemented that shows the daily statistics of the attacks found, alerts of attacks and also the SQLMAP tool was implemented for their prediction. An evaluation of functionality and usability was carried out on this tool, where the positive results are above 76%, indicating that the prototype meets the objectives.