2024 5th International Conference on Communications, Information, Electronic and Energy Systems (CIEES)

20 – 22 November, 2024, Veliko Tarnovo, Bulgaria

Collaborative Detection of SQL Injection Attacks

2024 5th International Conference on Communications, Information, Electronic and Energy Systems (CIEES) | 979-8-3503-5286-3/24/$31.00 ©2024 IEEE | DOI: 10.1109/CIEES62939.2024.10811420

using SIEM, Multi-Wazuh Agents, and Diverse Web

Application Firewalls
Mustaghfir Naufal Zaidan Parman Sukarno Aulia Arif Wardana
School of Informatics School of Informatics School of Informatics
Telkom University Telkom University Telkom University
Bandung, Indonesia Bandung, Indonesia Bandung, Indonesia
[email protected] [email protected] [email protected]

Abstract—SQL injection attacks pose a significant threat to stored procedures, which effectively reduce the risk of
web applications and database systems. This study evaluates the injecting malicious code. For instance, Ahmad and Karim [5]
effectiveness of integrating Security Information and Event developed an advanced parameterized stored procedure
Management (SIEM) with multi-Wazuh agents and diverse method, significantly enhancing security by preventing SQL
Web Application Firewalls (WAF) to detect threats injection attacks. Similarly, Mui and Frankl [6] proposed
collaboratively SQL injection attacks. The system was designed combining complementary character coding to prevent web
using two web servers, each protected by a different WAF— application injections, effectively mitigating SQL injection
ModSecurity and NAXSI—and a centralized SIEM server vulnerabilities.
employing Wazuh. Tests were conducted using various SQL
injection techniques, including Time-Based Blind, Error-Based, Integrating SIEM systems with multi-Wazuh agents and
and Union-Based attacks. The results indicated that heterogeneous WAFs presents a powerful approach for
ModSecurity proved more effective in detecting and mitigating detecting threats collaboratively SQL injection attacks. The
Time-Based and Error-Based SQL inj ection attacks, while both multi-Wazuh agents efficiently monitor and collect security
WAFs performed similarly in handling Union-Based attacks. data from various endpoints, which the SIEM system can then
The Wazuh platform collected and reported attack data centrally analyze to identify malicious SQL injection
efficiently, offering security teams a clear and centralized view attempts[7]. WAFs also play a crucial role in protecting web
of detected threats. This integration demonstrates the feasibility applications from injection attacks, including SQL
of implementing collaborative threat detection using a SIEM
injection[8]. By combining these technologies, organizations
and diverse WAFs to enhance web application security against
SQL injection attacks.
can establish a proactive security posture that not only detects
SQL injection attacks but also responds to them in real time,
Keywords—SQL injection, SIEM, WAF, multi-agent, thereby reducing the potential risk to their web applications
cybersecurity, collaborative detection and databases.

I. INTRODUCTION This study presents a novel approach by integrating the

Wazuh SIEM platform with multiple Web Application
SQL injection attacks pose a significant threat to web Firewalls (WAFs), specifically ModSecurity and NAXSI, for
applications and database systems. These vulnerabilities are collaborative detection and mitigation of SQL injection
frequently exploited by attackers to compromise website attacks. The key contributions of this research are outlined as
security and gain unauthorized access to sensitive information follows:
[1]. SQL injection attacks involve the injection of malicious
code into a database-driven web application, allowing • Integration of diverse WAFs and SIEM: This
attackers to manipulate the database and extract or modify study integrates Wazuh SIEM with ModSecurity
data [2]. As interactive web applications that rely on backend and NAXSI to enhance the detection of SQL
database services proliferate, the prevalence of SQL injection injection threats, focusing on Time-Based, Error-
attacks increases [3]. Based, and Union-Based SQL injection techniques.
The consequences of SQL injection attacks are severe, • Performance analysis of WAFs: The study
leading to unauthorized access to databases, information compares the effectiveness of ModSecurity and
leakage, and data falsification in web applications [4]. These NAXSI in detecting SQL injection attacks.
attacks not only result in data breaches but also compromise ModSecurity outperformed NAXSI in Time-Based
data integrity, disrupt server operations, and damage and Error-Based attacks, while both WAFs showed
organizational reputation [5]. Consequently, preventing SQL equal effectiveness in mitigating Union-Based
injection attacks is crucial to maintaining the confidentiality attacks.
and integrity of data stored in databases [6]. • Centralized threat monitoring: Using the Wazuh
To address this threat, researchers have explored various platform, the system efficiently collects and
approaches, including prevention techniques such as visualizes log data in real-time, improving threat
complementary character coding and enhanced parameterized detection and response times for security teams.

979-8-3503-5286-3/24/$31.00 ©2024 IEEE 1

Authorized licensed use limited to: St Petersburg Natl Uni of Info Tech Mech & Optics. Downloaded on March 21,2025 at 07:33:30 UTC from IEEE Xplore. Restrictions apply.
 Fig. 2. Network Topology

For example, in the realm of Industrial IoT security, the

Wazuh agent can receive outputs from machine learning
models in JSON log format and forward them to the server for
decoding and analysis [13].
III. RESEARCH METHOD
The research is conducted by rigorously testing and
evaluating the effectiveness of the integrated security
components, specifically the combination of SIEM with
Fig. 1. Research Stages ModSecurity and NAXSI WAF, in detecting and preventing
SQL injection attacks. This comprehensive analysis was
This research provides a scalable and efficient framework performed across several stages, as detailed in Fig. 1.
for enhancing web application security against SQL injection
attacks by leveraging the strengths of multiple WAFs A. Preparation Process
integrated within a SIEM platform. The preparation phase is the foundation of this research. In
this stage, a through literature review and expert consultations
II. THEORICAL BASIS were conducted to gain a full understanding of the key
A. Security Information and Event Management components and methods relevant to the study. The literature
review covered critical areas, including the role of Web
Security Information and Event Management (SIEM) Application Firewalls (WAFs) in enhancing web security, best
systems are indispensable in contemporary cybersecurity, practices for WAF implementation, detailed analyses of
providing a centralized platform for organizations to monitor, ModSecurity and NAXSI, WAF integration and configuration
analyze, and respond to security events. Unlike traditional on web servers, the deployment of Wazuh as a SIEM system,
Intrusion Detection Systems (IDS), SIEM systems offer a common web security threats, and the tools needed to
holistic approach to security event management. They gather implement and test these security measures in a controlled
and correlate security data from a variety of sources, environment.
including network devices, servers, endpoints, and security
B. Design And Implementation
tools. This comprehensive data collection enables security
analysts to effectively detect, investigate, and respond to In this phase, a detailed system design is created based on
security incidents[9]. the collected information. The design is implemented using
two web servers and a SIEM server. Fig. 2 shows the proposed
B. Web Application Firewall system architecture, highlighting the connectivity between the
Web Application Firewall (WAF) theory is anchored in SIEM server, WAF, and web servers to monitor and protect
the imperative to safeguard web applications from a myriad of against attacks. This design focuses on providing strong
cyber threats, particularly those exploiting vulnerabilities defense against SQL injection attacks by leveraging the
within web application code. A WAF serves as a defensive combined strengths of ModSecurity and NAXSI WAFs with
shield positioned between a web application and the internet, Wazuh’s centralized monitoring. Each web server is
functioning primarily as a reverse proxy that scrutinizes configured with a different WAF and includes a Damn
incoming and outgoing HTTP traffic. This inspection is Vulnerable Web Application (DVWA) to test the security
crucial for identifying and mitigating attacks such as SQL setup.
injection, cross-site scripting (XSS), and other malicious • Web Server 1 is safeguarded by the ModSecurity
activities that could compromise the integrity and WAF, which is specifically designed to filter traffic
confidentiality of web applications [10,11]. types such as HTTP/HTTPS, query strings, cross-site
C. Multi-Wazuh Agent scripting (XSS), and SQL injection attacks.
ModSecurity, an open-source module, can be
The Wazuh agent is a host-based security tool that
seamlessly integrated with the Apache2 web server. It
functions as an endpoint detection and response (EDR)
employs the OWASP Core Rule Set, a collection of
system, concentrating on infrastructure monitoring, security
pre-configured rules aimed at detecting and mitigating
risk identification, and incident response [12].
common web application attacks.

2
Authorized licensed use limited to: St Petersburg Natl Uni of Info Tech Mech & Optics. Downloaded on March 21,2025 at 07:33:30 UTC from IEEE Xplore. Restrictions apply.
 F:\Sqlmap\sqlmapproject-sqlmap-507c719>py sqlmap.py -u F:\Sqlmap\sqlmapproject-sqlmap-507c719>py sqlmap.py -u
http://192.168.26.128/dvwa/vulnerabilities/sqli/?id=1&Submit= http://192.168.26.128/dvwa/vulnerabilities/sqli/?id=1&Submit=
Submit# --level=5 --risk=3 --technique=T Submit# --level=5 --risk=3 --technique=U --
--cookie=”PHPSESSID=f219ntei506o1lvrf3ipomehq; cookie=”PHPSESSID=f219ntei506o1lvrf3ipomehq; security=low”
security=low”
Fig. 3. Time-Based Blind SQL Injection Attack Command Fig. 5. Union-Based SQL Injection Attack Command

F:\Sqlmap\sqlmapproject-sqlmap-507c719>py sqlmap.py -u …
http://192.168.26.128/dvwa/vulnerabilities/sqli/?id=1&Submit= [00:22:11] [CRITICAL] all tested parameters do not appear to be
Submit# --level=5 --risk=3 --technique=E injectable. Rerun without providing the option '--technique'. If you
--cookie=”PHPSESSID=f219ntei506o1lvrf3ipomehq; security=low” suspect that there is some kind of protection mechanism involved
(e.g. WAF) maybe you could try to use option '--tamper' (e.g. '--
tamper=space2comment') and/or switch '--random-agent'
Fig. 4. Error-Based SQL Injection Attack Command
[00:22:11] [WARNING] HTTP error codes detected during run:
To facilitate effective testing of the ModSecurity 403 (Forbidden) - 23351 times
configuration, the DVWA is utilized on this web server, …
simulating a vulnerable web application environment.
Fig. 6. Final Result of Time-Based SQL injection attack on web server 1
• Web server 2 is fortified by the NAXSI WAF,
seamlessly integrated with the NGINX web server. …
NAXSI, an open-source module, functions as a Web [09:56:04] [CRITICAL] all tested parameters do not appear to be
Application Firewall designed to detect and prevent injectable. Rerun without providing the option '--technique'. If you
web application attacks such as SQL injection and suspect that there is some kind of protection mechanism involved
Cross-Site Scripting (XSS). When incorporated with (e.g. WAF) maybe you could try to use option '--tamper' (e.g. '--
NGINX, NAXSI operates by utilizing a predefined set tamper=space2comment') and/or switch '--random-agent'
of rules to scrutinize and block suspicious [*] ending @ 09:56:04 /2024-09-09/
HTTP/HTTPS requests. The DVWA application was …
also deployed on this server to evaluate the efficacy of
the NAXSI configuration in mitigating security Fig. 7. Final Result of Time-Based SQL injection attack on web server 2
threats.
…
• The SIEM server in this design integrates the open- [10:18:45] [CRITICAL] all tested parameters do not appear to be
source security platform Wazuh, which is adept at injectable. Rerun without providing the option '--technique'. If you
security monitoring, threat detection, and incident suspect that there is some kind of protection mechanism involved
response. Each web server within this configuration is (e.g. WAF) maybe you could try to use option '--tamper' (e.g. '--
equipped with a Wazuh agent, responsible for tamper=space2comment') and/or switch '--random-agent'
[10:18:45] [WARNING] HTTP error codes detected during run: 403
collecting and transmitting logs from each WAF to the (Forbidden) - 14691 times
SIEM server. This setup ensures comprehensive [*] ending @ 10:18:45 /2024-09-09/
monitoring and enhances the system's ability to detect …

and respond to security threats in real-time. Fig. 8. Final Result of Error-Based SQL injection attack on web server 1
C. Testing
security=low reflects the low-security setting of the DVWA
The testing phase aims to evaluate the effectiveness of the
application, allowing for a more realistic test of vulnerable
configured WAFs and the Wazuh SIEM's ability to detect and
conditions. Notably, the cookies on Web Server 1 and Web
log SQL injection attacks. The SQLMap tool, an automated
tool for detecting and exploiting SQL injection vulnerabilities, Server 2 differ. Web Server 1, protected by ModSecurity,
is used for this purpose. uses a unique PHPSESSID, while Web Server 2, safeguarded
by NAXSI, has a different PHPSESSID, as each server
This evaluation employs a split attack scenario, with configures user sessions separately.
distinct attacks conducted against two different web servers at The following three attack techniques were implemented:
separate times. The attacks are executed by two different
attackers: a) Time-Based Blind SQL Injection
Time-Based Blind SQL Injection is a technique wherein
• Attacker 1 employed a Windows operating system to the attacker sends an SQL query that instructs the server to
initiate the attack against Web Server 1, which was delay its response for a specified duration. The success of the
fortified by ModSecurity. SQL injection is determined by measuring the server's
• Conversely, Attacker 2 utilized Kali Linux to execute response time, parameter to execute this technique, as
the attack on Web Server 2, which was safeguarded illustrated in Fig. 3. The primary goal is to exploit
by NAXSI. vulnerabilities that rely on response time for identification,
while evaluating the effectiveness of both the WAF and SIEM
Three SQL injection techniques were tested using level 5 in detecting and preventing such attacks.
and risk 3 parameters, as shown in Fig. 3. These settings were
selected to simulate more complex, high-risk attack scenarios. b) Error-Based SQL Injection
The parameter -- Error-Based SQL Injection is a method where attackers
cookie="PHPSESSID=56em8p1f97khn8u5gr9j5e08kfh;secu use server error messages to extract information about the
rity=low" was also used to ensure SQLMap ran within a valid database structure. By injecting SQL commands that trigger
user session. The PHPSESSID identifies the session, while errors, attackers can access crucial details like database type,

3
Authorized licensed use limited to: St Petersburg Natl Uni of Info Tech Mech & Optics. Downloaded on March 21,2025 at 07:33:30 UTC from IEEE Xplore. Restrictions apply.
 TABLE I. TOP 5 ALERTS OF TIME-BASED BLIND SQL INJECTION
…
No rule.description: Descending Count Percent [10:24:28] [CRITICAL] all tested parameters do not appear to be
injectable. Rerun without providing the option '--technique'. If
1 ModSecurity: Rejected a query 22683 37 % you suspect that there is some kind of protection mechanism
2 Web server 400 error code 15165 25 % involved (e.g. WAF) maybe you could try to use option '--tamper'
3 NAXSI warning 13347 22 % (e.g. '--tamper=space2comment') and/or switch '--random-
4 A web attack returned code 200 5160 9% agent'
(success)
5 SQL injection attempt 4133 7% [*] ending @ 10:24:28 /2024-09-09/
…
TABLE II. TOP 5 ALERTS OF ERROR-BASED SQL INJECTION
No rule.description: Descending Count Percent Fig. 9. Final Result of Error-Based SQL injection attack on web server 2
1 ModSecurity: Rejected a query 13340 37 %
2 NAXSI warning 8404 23 % …
3 Web server 400 error code 7720 22 % [11:52:08] [CRITICAL] all tested parameters do not appear to be
4 SQL injection attempt 3556 10 % injectable. Rerun without providing the option '--technique'. If
A web attack returned code 200 you suspect that there is some kind of protection mechanism
5 2772 8%
(success) involved (e.g. WAF) maybe you could try to use option '--tamper'
(e.g. '--tamper=space2comment') and/or switch '--random-
agent'
tables, columns, and other sensitive SQLMap uses the “--
technique=E” parameter, as shown in Fig. 4, to perform this [11:52:08] [WARNING] HTTP error codes detected during run:
technique. The main goal of this test is to assess how well the 403 (Forbidden) - 2079 times
Web Application Firewall (WAF) and Security Information
and Event Management (SIEM) system can detect and prevent [*] ending @ 11:52:08 /2024-09-09/
attacks exploiting server error messages, which often reveal …
system vulnerabilities.
Fig. 10. Final Result of Union-Based SQL injection attack on web server 1
c) Union-Based SQL Injection
Union-based SQL injection is a method that leverages the …
[11:53:00] [CRITICAL] all tested parameters do not appear to be
SQL UNION clause to merge results from legitimate queries
injectable. Rerun without providing the option '--technique'. If
with those from maliciously crafted ones. This technique
you suspect that there is some kind of protection mechanism
enables attackers to extract data from other tables within the involved (e.g. WAF) maybe you could try to use option '--tamper'
database by combining legitimate results with queries that (e.g. '--tamper=space2comment') and/or switch '--random-agent'
introduce harmful data. SQLMap utilizes the “--technique=U”
parameter to exploit this method, as illustrated in Fig. 5. [*] ending @ 11:53:00 /2024-09-09/
Implementing the --technique=U parameter demonstrates how …
SQLMap initiates tests using the Union-Based SQL Injection
technique, where manipulated SQL queries can reveal Fig. 11. Final Result of Union-Based SQL injection attack on web server 2
sensitive information from different database tables.
IV. DISCUSSION
D. Data Collection This chapter elucidates the outcomes of SQL Injection
In this section, the log data for each SQL Injection attack attack assessments conducted on two distinct web servers,
tested is meticulously collected via the Wazuh Dashboard. each configured with different Web Application Firewalls
Wazuh provides detailed logs for each attack on the server (WAFs) and monitored via the Wazuh Security Information
dashboards, encompassing critical information such as the and Event Management (SIEM) platform. The testing
time of occurrence and the attacker's IP address. This report scenarios were methodically executed on each web server
presents an alerts summary, which includes a comprehensive independently, enabling a comprehensive evaluation of the
description of each threat and the number of events detected efficacy of each WAF in isolation.
by the WAF system on both servers. This summary serves as
a clear indicator of the system's effectiveness in identifying A. Time-Based Blind SQL Injection Attack
and mitigating attacks, demonstrating that the detailed logs are a) Modsecurity
successfully captured by Wazuh across both servers. The results of tests conducted on Web Server 1
E. Analysis demonstrated that ModSecurity effectively mitigated the
Time-Based Blind SQL Injection attacks, as illustrated in Fig.
The results of each attack will be meticulously analyzed to 6. ModSecurity efficiently detected and obstructed the attack
determine the efficacy of the WAF in thwarting the attack and attempts, thereby safeguarding the server from potential time-
the proficiency of the Wazuh SIEM in detecting and logging based exploitation.
each attempt. The comprehensive log data generated from
each attack will provide valuable insights into the system's b) NAXSI
capability to identify and counter SQL injection threats. The analysis of Web Server 2 indicates that NAXSI
effectively mitigates Time-Based Blind SQL Injection
attacks, as illustrated in Fig. 7. Although approximately 9% of
Time-Based Blind SQL Injection payloads were detected by
Wazuh through the Apache2 logs on Web Server 2, the
server's response code of 200 (Success) suggests that these
were false positives.

4
Authorized licensed use limited to: St Petersburg Natl Uni of Info Tech Mech & Optics. Downloaded on March 21,2025 at 07:33:30 UTC from IEEE Xplore. Restrictions apply.
 TABLE III. UNION-BASED SQL INJECTION WAZUH DASHBOARD ModSecurity, the Web Application Firewall (WAF)
No rule.description: Descending Count Percent effectively intercepted and blocked the malicious activity. The
1 ModSecurity: Rejected a query 2,065 48 % attack, which attempted to exploit the UNION clause in SQL
2 Web server 400 error code 1,428 33 % queries to extract sensitive information, was thwarted without
3 NAXSI warning 576 14 % any data leakage. As depicted in Figure 10, ModSecurity's
4 Multiple web server 400 error codes 113 3%
from same source ip robust security protocols successfully neutralized the threat by
5 SQL injection attempt 99 2% identifying and blocking the unauthorized queries, thereby
ensuring the integrity and confidentiality of the database.
A 200 response indicates that the server successfully
processed the request, but it does not confirm a successful b) NAXSI
exploitation of a vulnerability.This outcome underscores the The results of the Union-Based SQL Injection attack on
robustness of NAXSI in safeguarding the server from such Web Server 2, protected by NAXSI, indicated that the WAF
attacks. effectively identified and mitigated the threat, thereby
preventing any leakage of sensitive information. As illustrated
c) Wazuh in Fig. 11, NAXSI successfully flagged and blocked malicious
In this assessment, Wazuh effectively identified and SQL commands, ensuring unauthorized data access attempts
categorized key security threats using logs from both Web were thwarted. The rule set employed by NAXSI was able to
Server 1 and Web Server 2, as seen in Table I. These included detect the UNION query and deliver an appropriate defensive
attacks blocked by ModSecurity (37%), client errors (25%) response, safeguarding the integrity of the server.
from Web Server 1, and injection attempts by NAXSI (22%).
Wazuh also logged SQL injection attempts (7%) and c) Wazuh
successful web attacks (9%) from Web Server 2. Through During the testing of both web servers, Wazuh effectively
centralized reporting, Wazuh collects data from multiple gathered and categorized data from each SQL injection
devices, helping security teams prioritize responses. The attempt. Table III provides a detailed analysis, showing how
graph in Table I shows threat proportions, supporting resource Wazuh logs union-based attack attempts and classifies
allocation to vulnerable areas. Wazuh's continuous monitoring security events from both ModSecurity and NAXSI. Wazuh's
supports data-driven decisions in managing security risks. centralized monitoring allowed for real-time threat detection
and in-depth post-incident analysis of the servers' responses to
B. Error-Based SQL Injection SQL injection attacks. The report highlights Wazuh's
a) Modsecurity capability to track multiple defense layers and record critical
The evaluation of an error-based SQL Injection attack on events for further analysis
Web Server 1, which is safeguarded by ModSecurity, D. Analysis
demonstrated the WAF's efficacy in detecting and thwarting
such threats, as illustrated in Fig. 8. ModSecurity's response The data collected and visualized in the Wazuh Dashboard
involved logging the injection attempt and issuing a rule- revealed distinct differences in how ModSecurity and NAXSI
based error response. Consequently, no data was exfiltrated handled each SQL injection technique. The detailed analysis
from the database, affirming the WAF's capability to protect of log data highlights the varied responses of the two WAFs,
the server from potential exploitation. showing how Wazuh effectively categorizes and displays
these findings:
b) NAXSI
a) Time-Based Blind SQL Injection
In the test conducted on Web Server 2 protected by
NAXSI, the system successfully detected and blocked the The analysis showed that ModSecurity blocked almost all
attack, as illustrated in Fig. 9. Similar to ModSecurity, NAXSI Time-Based Blind SQL Injection attempts, as confirmed by
could identify error-based SQL Injection attack patterns and the logs. Meanwhile, NAXSI had around 9% of payloads
provide appropriate responses. However, some HTTP 200 return a code 200 (success), indicating false positives rather
success responses indicated false positives, where the attack than successful attacks. The Wazuh Dashboard clearly
was logged but did not successfully extract sensitive highlights these discrepancies, demonstrating that
information. ModSecurity offers stronger protection for this type of attack,
while NAXSI's false positives require further review.
c) Wazuh
b) Error-Based SQL Injection:
Wazuh, as the SIEM platform monitoring both web
servers, efficiently collected logs from ModSecurity and ModSecurity successfully blocked all Error-Based SQL
NAXSI. The Wazuh dashboard, illustrated in Table II, Injection attempts, while NAXSI detected the attacks but
displays comprehensive data from both servers, documenting showed some false positives, with code 200 responses despite
the number of attack attempts and the outcomes. This data no sensitive data being compromised. The Wazuh Dashboard
reveals that the majority of attacks were successfully blocked thoroughly recorded these events, emphasizing the differences
by the WAF, although a few false positives displayed a 200 in error handling between the two WAFs. ModSecurity
(success) code. Wazuh effectively identifies SQL injection outperformed NAXSI in preventing these errors.
attempts and reports critical threats in a structured and easily c) Union-Based SQL Injection:
analyzable manner, thereby aiding the security team in The results of the Union-Based SQL Injection testing
prioritizing threat mitigation efforts. indicated that both ModSecurity and NAXSI effectively
C. Union-Based SQL Injection blocked the attacks without exposing any sensitive data. The
logs aggregated and presented by Wazuh provided a clear
a) Modsecurity
distribution of blocked attack attempts from both web servers.
During the assessment of a Union-Based SQL Injection For this specific technique, both WAFs demonstrated
attack on Web Server 1, which was safeguarded by

5
Authorized licensed use limited to: St Petersburg Natl Uni of Info Tech Mech & Optics. Downloaded on March 21,2025 at 07:33:30 UTC from IEEE Xplore. Restrictions apply.
 comparable performance, which was accurately reflected in [3] Y. Kosuga, K. Kono, M. Hanaoka, M. Hishiyama and Y. Takahama,
the Wazuh Dashboard without any significant false positives. "Sania: Syntactic and Semantic Analysis for Automated Testing
against SQL Injection," Twenty-Third Annual Computer Security
E. Comparison with Existing Solutions Applications Conference (ACSAC 2007), Miami Beach, FL, USA,
2007, pp. 107-117, doi: 10.1109/ACSAC.2007.20.
The comparison between this study and references [14] [4] T. Matsuda, “On the Property of the Distribution of Symbols in SQL
and [15] reveals notable differences in technology, attack Injection Attack,” International Journal of Intelligent Computing
types, and protection methods. This study integrates Wazuh Research, vol. 4, no. 4, 2013, pp. 376-381.
SIEM with two different WAFs (ModSecurity and NAXSI), https://doi.org/10.20533/ijicr.2042.4655.2013.0049
while [14] uses ModSecurity with a reverse proxy, and [15] [5] K. Ahmad and M. Karim, "A Method to Prevent SQL Injection Attack
combines SIEM with a proxy and WAF in a WordPress setup. using an Improved Parameterized Stored Procedure," International
Journal of Advanced Computer Science and Applications, vol. 12, (6),
Unlike this study, which focuses solely on SQL Injection 2021. https://doi.org/10.14569/IJACSA.2021.0120636.
(Time-Based, Error-Based, Union-Based), both [14] and [15] [6] R. Mui, and P. Frankl, “Preventing Web Application Injections with
cover a wider range of attacks, including SQL Injection, Complementary Character Coding,” vol. 6879, 2011, pp. 80-99.
Cross-Site Scripting (XSS), and Local File Inclusion (LFI). In https://doi.org/10.1007/978-3-642-23822-2_5.
terms of protection, this study prioritizes collaborative [7] C. Pinzón, J. Paz, Á. Herrero, E. Corchado, J. Bajo, and J. Corchado,
detection using multiple WAFs and SIEM, whereas [14] and “IDMAS-SQL: Intrusion Detection Based on MAS to Detect and
[15] mainly rely on ModSecurity, reverse proxy, and SIEM Block SQL Injection Through Data Mining. Information Sciences,”
vol. 231, 2013, pp. 15-31. https://doi.org/10.1016/j.ins.2011.06.020
for visualization in more limited contexts. Performance-wise,
[8] J. Harefa, G. Prajena, A. Alexander, A. Muhamad, E. Dewa, and S.
this study reports 100% accuracy for ModSecurity and 91% Yuliandry, “SEA WAF: The Prevention of SQL Injection Attacks on
for NAXSI (Time-Based SQL Injection), while [14] shows Web Applications. Advances in Science,” Technology and
full detection without NAXSI, and [15] reports high detection Engineering Systems Journal, vol. 6, no. 2, 2021, pp. 405-411.
rates (97% for SQL Injection, 100% for XSS, 74% for LFI). https://doi.org/10.25046/aj060247.
Only this study addresses false positives, noting a 9% rate for [9] R. Zuech, T. Khoshgoftaar, and R. Wald, "Intrusion detection and big
NAXSI, which is not mentioned in [14] or [15]. Overall, this heterogeneous data: a survey", Journal of Big Data, vol. 2, no. 1, 2015.
https://doi.org/10.1186/s40537-015-0013-4.
study stands out by integrating multiple WAFs with SIEM for
more comprehensive threat detection, compared to the [10] B. Dawadi, B. Adhikari, and D. Srivastava, "Deep learning technique-
enabled web application firewall for the detection of web attacks",
narrower approaches in [14] and [15]. Sensors, vol. 23, no. 4, p. 2073, 2023. https://doi.org/10.3390/
s23042073.
V. CONCLUSION [11] A. Alquwayzani, "Mitigating security risks in firewalls and web
This research integrates the Wazuh SIEM platform with applications using vulnerability assessment and penetration testing
multiple Web Application Firewalls (WAFs) to detect SQL (vapt)", International Journal of Advanced Computer Science and
Applications, vol. 15, no. 5, 2024. https://doi.org/10.14569/
Injection attacks collaboratively. The results show that ijacsa.2024.01505136
ModSecurity outperformed NAXSI in detecting Time-Based [12] J. R. Nandaputra, P. Sukarno, and A. A. Wardana. 2024. “Detection
and Error-Based SQL Injection attacks, with fewer false and Prevention System on Computer Network to Handle Distributed
positives. Both WAFs were equally effective in mitigating Denial-Of-Service (Ddos) Attack in Realtime and Multi-Agent.” 2024
Union-Based attacks. Wazuh SIEM efficiently aggregated log 10th International Conference on Computer Technology Applications
data, providing clear insights and improving response (ICCTA '24). pp. 237–241. https://doi.org/10.1145/3674558.3674592
efficiency. Overall, the integration of ModSecurity and [13] H. Zahid, S. Hina, M.F. Hayat, G.A. Shah, “Agentless Approach for
Security Information and Event Management in Industrial IoT.”
NAXSI with Wazuh SIEM enhanced threat detection, Electronics 2023, vol. 12, 1831. https://doi.org/10.3390/
demonstrating the potential of using multiple WAFs within a electronics12081831.
SIEM framework for better threat management. [14] R. A. Muzaki, O. C. Briliyant, M. A. Hasditama and H. Ritchi,
"Improving Security of Web-Based Application Using ModSecurity
REFERENCES and Reverse Proxy in Web Application Firewall," 2020 International
[1] F. Q. Kareem, “SQL Injection Attacks Prevention System Technology: Workshop on Big Data and Information Security (IWBIS), Depok,
Review”, Asian J. Res. Com. Sci., vol. 10, no. 3, pp. 13–32, Jul. 2021. Indonesia, 2020, pp. 85-90, doi: 10.1109/IWBIS50925.2020.9255601.
[2] H. Bahruddin, V. Suryani, and A.A. Wardana, “Adversary Simulation [15] T. Rahmawati, R. W. Shiddiq, M. R. Sumpena, S. Setiawan, N. Karna
of Structured Query Language (SQL) Injection Attack Using Genetic and S. N. Hertiana, "Web Application Firewall Using Proxy and
Algorithm for Web Application Firewalls (WAF) Bypass”. In: Arai, K. Security Information and Event Management (SIEM) for OWASP
(eds) Intelligent Systems and Applications. IntelliSys 2023. Lecture Cyber Attack Detection," 2023 IEEE International Conference on
Notes in Networks and Systems, vol 823. Springer, Cham. Internet of Things and Intelligence Systems (IoTaIS), Bali, Indonesia,
https://doi.org/10.1007/978-3-031-47724-9_43 2023, pp. 280-285, doi: 10.1109/IoTaIS60147.2023.10346051.

6
Authorized licensed use limited to: St Petersburg Natl Uni of Info Tech Mech & Optics. Downloaded on March 21,2025 at 07:33:30 UTC from IEEE Xplore. Restrictions apply.