sqld

SQL Detector

The sqld service type implements SQL injection attack detection. Regular expressions and a GRU recurrent neural network are used to detect SQL injection attacks.

The available service settings are as follows:

The available input for the request are as follows:

The available response outputs are as follows:

A sample service definition is:

{
  "name": "SQLSecurity",
  "description": "Look for sql injection attacks",
  "ref": "github.com/AiRISTAFlowInc/fs-microgateway/activity/sqld"
}

An example step that invokes the above SQLSecurity service using payload is:

{
  "service": "SQLSecurity",
  "input": {
    "payload": "=$.payload"
  }
}

Utilizing the response values can be seen in a response handler:

{
  "if": "$.SQLSecurity.outputs.attack > 80",
  "error": true,
  "output": {
    "code": 403,
    "data": {
      "error": "hack attack!",
      "attackValues": "=$.SQLSecurity.outputs.attackValues"
    }
  }
}