# Toward an SDN-Based Web Application Firewall: Defending against SQL Injection Attacks
## 3 Related Work  
In this section, we review related works that focus on utilizing SDN to implement firewalls against network attacks and security mechanisms using DPI. We also discuss recent research on regular expression implementation and the application of DPI to detect SQL injection attacks in non-SDN environments, such as traditional networks and cloud environments. Finally, we highlight the novelty of our work in SDN environments. Although the literature does not extensively discuss implementing security solutions for web applications using SDN, there are several solutions that utilize features implemented in WAFs, such as DPI [22; 23]. DPI involves inspecting the contents of network packets at the application layer to identify patterns or signatures of known attacks. SDN controllers can be programmed to use DPI techniques to analyze the payload of network packets and identify suspicious patterns that may indicate application-level attacks, such as SQL injection, cross-site scripting (XSS), or command injection attacks. Researchers have utilized SDN features to analyze both SMB and HTTP traffic for the purpose of detecting and blocking ransomware [22]. In order to enable DPI, the authors modified the POX controller to allow for full traffic forwarding from the OpenFlow switch to the controller. Other works have also explored the use of SDN for application layer firewalls, aiming to block hosts from accessing specific websites [24; 25]. Additionally, network firewalls for SDN have been investigated by various researchers. Early efforts focused on implementing a layer 3 firewall that matches rules with packet headers [26]. Subsequently, researchers extended this work to implement stateless layer 2 [27], layer 1-4 [28], layer 2-4 [29], and stateful firewalls [30; 31]. The authors of [32] proposed generating regular expression rules automatically using machine learning and multi-objective genetic algorithms to detect SQL injection attacks. In the cloud environment, the authors of [33] proposed a system that inspects traffic using regular expressions to raise awareness among cloud tenants and assess SQL injection attacks. Although SDN security has been studied in the literature, there is a lack of explicit focus on implementing a WAF to block web attacks. The only existing works on layer 7 firewalls have aimed at preventing access to certain websites, without addressing web attacks directly [24; 25]. Given the increasing prevalence and impact of web attacks, it is crucial to explore solutions for web attacks that consider the novelty of SDN and its growing adoption by organizations. Therefore, this work aims to contribute to the literature by implementing an SDN-based WAF to mitigate web attacks. Furthermore, our work shares two goals with [26]: to raise awareness among information security researchers about the potential of SDN as a new field and to explore the feasibility of relying on custom SDN-based security solutions without the need for proprietary software or hardware. However, our work differs from [26] in that we specifically aim to design a firewall to mitigate web attacks, whereas most previous works have focused on network-level attacks. Figure 2: DPI architecture based on the TCP/IP model. This distinction highlights the unique contribution of our work in addressing the specific challenges and requirements of web application security in an SDN environment. In addition to DPI, there are other methods that can also be used in SDN environments to detect application-level attacks. Some of the commonly used methods include:  
* Flow Monitoring: SDN controllers can monitor network flows, which are sequences of packets that belong to the same communication session or application transaction, in order to detect anomalies that may indicate application-level attacks [34]. Flow monitoring involves analyzing various flow attributes, such as the packet size, packet rate, inter-arrival time, and communication patterns, to detect deviations from normal behavior that may indicate attacks.