# Toward an SDN-Based Web Application Firewall: Defending against SQL Injection Attacks
## 6 Implementation
### SQL Injection Detection
#### 6.2.2 Module 2: Regular-Expression-Based  
Regular expressions are commonly used to detect attacks against web applications. Thus, the possibility of using them in SDN was studied. In this module, we implemented regular expressions to scan traffic for GET requests and then extract the URL path. If no path is requested, the traffic will be forwarded to the web server. For example, a path can be defined as \filename.php?id=[0-9]. If this path exists in the request, the application will move to the next stage, which compares the path with the predefined path extracted from our analysis of HTTP GET requests in SDN. The path should be \filename.php?id=[0-9] http. If there are changes in this path, the request is considered malicious. Algorithm 2 shows the design of this module and the regular expression used for detection. Note that  
\begin{table}
\begin{tabular}{c c c c} \hline order\%20 by & order by & order+by & union all \\ \hline union+all & union\%20 all & union\%20 all & 1,2,3 \\ \hline union+select & union\%20 select & union select & version() \\ \hline \end{tabular}
\end{table}
Table 1: Signatures used to detect SQL injection.  
the example provided is just one possible case; in our work, we thoroughly examined all possible paths.  
```
1:PacketIn event
2:None
3:Signature-based algorithm
4:\(\mathit{packet}\leftarrow\mathit{PacketIn.tcp}\)
5:\(\mathit{signatures}\leftarrow\) \"\(\mathit{order+by}\)\", \"\(\mathit{union}\)\(\mathit{select}\)\", \"\(\mathit{union+select}\)\", \"\(\mathit{order}\) by\", etc.
6:if\(\mathit{packet}\) is None then
7:return
8:elseif\(\mathit{packet.dstport}\) == 80 then
9:for\(i\) in \(\mathit{signatures}\)do
10:if\(\mathit{packet.find(i)}\)is True then
11: Install new entry to block the sender IP address from sending from port 80
12:PacketIn.halt
13:else
14:return
15:endif
16:endfor
17:else
18:return
19:endif
```  
**Algorithm 1** Signature-based algorithm  
```
1:PacketIn event
2:None
3:Return
4:\(\mathit{packet}\leftarrow\mathit{PacketIn.tcp}\)
5:\(\mathit{FirstReg}\leftarrow\) re.compile(\"([\(\wedge\)\(\wedge\).-]+)\(\backslash\)?([\(\wedge\)\(\wedge\).-]+)\(\backslash\)=([\(\wedge\)\(\wedge\).-]+)\(\backslash\)s*\")
6:\(\mathit{SecondReg}\leftarrow\) re.compile(\"([\(\(\backslash\)\(\wedge\).-]+)\(\backslash\)?([\(\wedge\)\(\wedge\).-]+)\(\backslash\)=([\(\wedge\)\(\wedge\).-]+)\(\backslash\)s*(http+)\")
7:if\(\mathit{packet}\) is None then
8:return
9:elseif\(\mathit{packet.dstport}\) == 80 then
10:if\(\mathit{FirstReg.search(packet)}\)then
11:if\(\mathit{SecondReg.search(packet)}\)is None then
12: Install new entry to block the sender IP address from sending from port 80
13:\(\mathit{PacketIn.halt}\)
14:else
15:return
16:endif
```  
**Algorithm 2** Regular-expression-based algorithm  
The proposed SDN-based web firewall can efficiently scale to detect multiple types of attacks, such as cross-site scripting (XSS) and local file inclusion (LFI), by leveraging both signature-based and regular expression components when processing traffic directed toward the web server. Additionally, incorporating statistical features, such as the number of exchanged packets, could further enhance the approach to address various attack types.