Detecting Cypher Injection with Open-Source Network Intrusion Detection

Security researcher John Lambert once said, "Defenders think in lists. Attackers think in graphs" (Lambert, 2015), but attackers do not simply think in graphs; they can attack graphs using a technique called Cypher injection. Cypher, a language used to query graph databases such as Neo4j, is vulnerable to a class of attacks called query injection.