用日志数据识别MongoDB注入攻击，准确率达71%。
MongoDB Injection Query Classification Model using MongoDB Log files as Training Data
- 基于日志和提取特征，不依赖原始查询语句进行分类。
- 最佳模型为FLAML的XGBoost限深版，准确率71%。
- 适合关注数据库安全检测的开发者与安全研究人员。
NoSQL注入攻击是攻击者向NoSQL数据库发送精心构造的查询，导致执行未授权操作的一类网络攻击。早期基于规则的防御系统被发现无法应对新型攻击，因此转向模型驱动方法。然而，现有模型大多仅使用发送给服务器的查询语句进行训练，在真实场景中因数据稀缺和类别不平衡问题表现不佳。本文研究基于MongoDB日志数据及其他提取特征（排除原始查询语句）对注入攻击进行分类。实验在模拟空数据库上收集日志，经处理后通过判别分析筛选出统计显著特征，构建特征数据集。采用FLAML自动化机器学习库及6种手动设计模型，在50组随机采样数据上交叉验证并评估。结果显示，最优模型为FLAML的"XGBoost limited depth"，准确率达71%。
原文摘要 · Abstract (English)
NoSQL Injection attacks are a class of cybersecurity attacks where an attacker sends a specifically engineered query to a NoSQL database which then performs an unauthorized operation. To defend against such attacks, rule based systems were initially developed but then were found to be ineffective to innovative injection attacks hence a model based approach was developed. Most model based detection systems, during testing gave exponentially positive results but were trained only on the query statement sent to the server. However due to the scarcity of data and class imbalances these model based systems were found to be not effective against all attacks in the real world. This paper explores classifying NoSQL injection attacks sent to a MongoDB server based on Log Data, and other extracted features excluding raw query statements. The log data was collected from a simulated attack on an empty MongoDB server which was then processed and explored. A discriminant analysis was carried out to determine statistically significant features to discriminate between injection and benign queries resulting in a dataset of significant features. Several Machine learning based classification models using an AutoML library, "FLAML", as well as 6 manually programmed models were trained on this dataset , which were then trained on 50 randomized samples of data, cross validated and evaluated. The study found that the best model was the "FLAML" library's "XGBoost limited depth" model with an accuracy of 71%.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。