Patent Document ID: 8225402
Application ID: 12420681

Base Claim:
1. A method for detecting a structured query language (SQL) injection attack, the method performed by a computer executing computer-readable code embodied on a computer-readable storage device, the method comprising the steps of: a) transforming, by the computer, a new SQL query into a new SQL token domain query; and b) applying a n-gram analysis together with a threshold and an averaging vector to the new SQL token domain query to determine whether or not the SQL query is an injection attack query, wherein the applying the n-gram analysis together with threshold and averaging vector includes: i. obtaining a filtered matrix, ii. reshaping the filtered matrix as a row vector, iii. dividing each entry in the row vector by a corresponding entry in the averaging vector to obtain a new vector, iv. calculating an inner product of the new vector with a random vector to obtain a result, and v. comparing the result with the threshold.

---

Claim 3:
3. The method of claim 1 , wherein the step of transforming the new SQL query into a new SQL token domain query and the step of applying a n-gram analysis together with a threshold and an averaging vector to the new SQL token domain query are performed online in real time.