{"id":{"repo_id":"mit","oai_identifier":"oai:dspace.mit.edu:1721.1/77451"},"canonical_url":"https://search.dev.ndltd.org/etd/mit/oai:dspace.mit.edu:1721.1/77451","repository":{"repo_id":"mit","name":"MIT","base_url":"https://dspace.mit.edu/oai/request"},"display":{"title":"Preventing injection attacks through automated randomization of keywords","abstract":"SQL injection attacks are a major security issue for database-backed web applications, yet the most common approaches to prevention require a great deal of programmer effort and attention. Even one unchecked vulnerability can lead to the compromise of an entire application and its data. We present a fully automated system for securing applications against SQL injection which can be applied at runtime. Our system mutates SQL keywords in the program's string constants as they are loaded, and instruments the program's database accesses so that we can verify that all keywords in the final query string have been properly mutated, before passing it to the database. We instrument other method calls within the program to ensure correct program operation, despite the fact that its string constants have been mutated. Additionally, we instrument places where the program generates user-visible output to ensure that randomized keyword mutations are never revealed to an attacker.","abstract_html":"SQL injection attacks are a major security issue for database-backed web applications, yet the most common approaches to prevention require a great deal of programmer effort and attention. Even one unchecked vulnerability can lead to the compromise of an entire application and its data. We present a fully automated system for securing applications against SQL injection which can be applied at runtime. Our system mutates SQL keywords in the program's string constants as they are loaded, and instruments the program's database accesses so that we can verify that all keywords in the final query string have been properly mutated, before passing it to the database. We instrument other method calls within the program to ensure correct program operation, despite the fact that its string constants have been mutated. Additionally, we instrument places where the program generates user-visible output to ensure that randomized keyword mutations are never revealed to an attacker.","abstract_has_math":false,"creators":["Willenson, Daniel M"],"institution":"Massachusetts Institute of Technology","degree_name":null,"degree_level":null,"degree_discipline":null,"degree_department":"Massachusetts Institute of Technology. Dept. of Electrical Engineering and Computer Science.","school":null,"contributors":[],"advisors":["Jeff Perkins and Martin Rinard."],"committee_chairs":[],"committee_members":[],"year":2012,"date_issued":"2012","date_published":"2012","updated_at":"2026-07-22T22:21:39Z","subjects":["Electrical Engineering and Computer Science."],"languages":["eng"],"rights":["M.I.T. theses are protected by copyright. They may be viewed from this source for any purpose, but reproduction or distribution in any format is prohibited without written permission. See provided URL for inquiries about permission."],"rights_urls":["http://dspace.mit.edu/handle/1721.1/7582"],"identifier_entries":[]},"links":{"outbound_url":"http://hdl.handle.net/1721.1/77451","outbound_label":"Handle","outbound_source":"dc:identifier.uri"},"metadata_groups":[{"id":"people","label":"People","entries":[{"key":"dc:contributor.advisor","label":"Advisor","values":["Jeff Perkins and Martin Rinard."]},{"key":"dc:contributor.department","label":"Department","values":["Massachusetts Institute of Technology. Dept. of Electrical Engineering and Computer Science."]},{"key":"dc:contributor.other","label":"Dc Contributor Other","values":["Massachusetts Institute of Technology. Dept. of Electrical Engineering and Computer Science."]},{"key":"dc:creator","label":"Author","values":["Willenson, Daniel M"]}]},{"id":"academic_context","label":"Academic Context","entries":[{"key":"dc:date.accessioned","label":"Dc Date Accessioned","values":["2013-03-01T15:06:33Z"]},{"key":"dc:date.available","label":"Dc Date Available","values":["2013-03-01T15:06:33Z"]},{"key":"dc:date.issued","label":"Date","values":["2012"]},{"key":"dc:publisher","label":"Institution","values":["Massachusetts Institute of Technology"]},{"key":"dc:type","label":"Dc Type","values":["Thesis"]}]},{"id":"subjects_keywords","label":"Subjects and Keywords","entries":[{"key":"dc:subject","label":"Dc Subject","values":["Electrical Engineering and Computer Science."]}]},{"id":"language_rights","label":"Language and Rights","entries":[{"key":"dc:language.iso","label":"Language (ISO)","values":["eng"]},{"key":"dc:rights","label":"Dc Rights","values":["M.I.T. theses are protected by copyright. They may be viewed from this source for any purpose, but reproduction or distribution in any format is prohibited without written permission. See provided URL for inquiries about permission."]},{"key":"dc:rights.uri","label":"Rights URI","values":["http://dspace.mit.edu/handle/1721.1/7582"]}]},{"id":"identifiers","label":"Identifiers","entries":[{"key":"dc:identifier.uri","label":"Identifier URI","values":["http://hdl.handle.net/1721.1/77451"]}]},{"id":"additional","label":"Additional Metadata","entries":[{"key":"dc:description","label":"Description","values":["Thesis (M. Eng. and S.B.)--Massachusetts Institute of Technology, Dept. of Electrical Engineering and Computer Science, 2012.","Cataloged from PDF version of thesis.","Includes bibliographical references (p. 47-48)."]},{"key":"dc:description.abstract","label":"Abstract","values":["SQL injection attacks are a major security issue for database-backed web applications, yet the most common approaches to prevention require a great deal of programmer effort and attention. Even one unchecked vulnerability can lead to the compromise of an entire application and its data. We present a fully automated system for securing applications against SQL injection which can be applied at runtime. Our system mutates SQL keywords in the program's string constants as they are loaded, and instruments the program's database accesses so that we can verify that all keywords in the final query string have been properly mutated, before passing it to the database. We instrument other method calls within the program to ensure correct program operation, despite the fact that its string constants have been mutated. Additionally, we instrument places where the program generates user-visible output to ensure that randomized keyword mutations are never revealed to an attacker."]},{"key":"dc:description.degree","label":"Dc Description Degree","values":["M.Eng.and S.B."]},{"key":"dc:title","label":"Title","values":["Preventing injection attacks through automated randomization of keywords"]}]}],"canonical_facts":{"dc:contributor.advisor":["Jeff Perkins and Martin Rinard."],"dc:contributor.department":["Massachusetts Institute of Technology. Dept. of Electrical Engineering and Computer Science."],"dc:contributor.other":["Massachusetts Institute of Technology. Dept. of Electrical Engineering and Computer Science."],"dc:creator":["Willenson, Daniel M"],"dc:date.accessioned":["2013-03-01T15:06:33Z"],"dc:date.available":["2013-03-01T15:06:33Z"],"dc:date.issued":["2012"],"dc:description":["Thesis (M. Eng. and S.B.)--Massachusetts Institute of Technology, Dept. of Electrical Engineering and Computer Science, 2012.","Cataloged from PDF version of thesis.","Includes bibliographical references (p. 47-48)."],"dc:description.abstract":["SQL injection attacks are a major security issue for database-backed web applications, yet the most common approaches to prevention require a great deal of programmer effort and attention. Even one unchecked vulnerability can lead to the compromise of an entire application and its data. We present a fully automated system for securing applications against SQL injection which can be applied at runtime. Our system mutates SQL keywords in the program's string constants as they are loaded, and instruments the program's database accesses so that we can verify that all keywords in the final query string have been properly mutated, before passing it to the database. We instrument other method calls within the program to ensure correct program operation, despite the fact that its string constants have been mutated. Additionally, we instrument places where the program generates user-visible output to ensure that randomized keyword mutations are never revealed to an attacker."],"dc:description.degree":["M.Eng.and S.B."],"dc:identifier.uri":["http://hdl.handle.net/1721.1/77451"],"dc:language.iso":["eng"],"dc:publisher":["Massachusetts Institute of Technology"],"dc:rights":["M.I.T. theses are protected by copyright. They may be viewed from this source for any purpose, but reproduction or distribution in any format is prohibited without written permission. See provided URL for inquiries about permission."],"dc:rights.uri":["http://dspace.mit.edu/handle/1721.1/7582"],"dc:subject":["Electrical Engineering and Computer Science."],"dc:title":["Preventing injection attacks through automated randomization of keywords"],"dc:type":["Thesis"]},"updated_at":"2026-07-22T22:21:39Z"}