Anomaly SQL SELECT-Statement Detection Using Entropy Analysis

Database systems are often intruded because they store valuable information and can be accessed through Internet web applications which sometimes are not developed with security in mind. Attackers can inject some crafted inputs to those programs that work on database systems so that some unexpected results occur. We analyze the database system log files, focus on query statements (SQL SELECT statements), using the Shannon entropy to detect such anomaly attempts that would change conditional entropy significantly. Our experiment shows that the proposed anomaly detection using entropy analysis is effective.