Detection Of SQL Injection Attacks Research Articles

Comprehensive review of machine learning models for sql injection detection in e-commerce

With the steady expansion of online commerce, e-commerce sites have become increasingly attractive targets for hackers. These sites serve millions of customers and often hold valuable, confidential, and sometimes financial information in their databases. One particularly dangerous type of attack is SQL injection, which exploits vulnerabilities in web applications to influence backend databases, posing significant threats to such platforms. Traditional defenses like desktop firewalls, input validation, and parameterized queries provide some level of protection but are often insufficient against newer injection variations and sophisticated attackers. The utilization of machine learning to enhance cybersecurity against more advanced threats has been demonstrated as a promising approach. This systematic review examines how various machine learning algorithms are applied to detect SQL injection attacks that could potentially harm e-commerce systems. By identifying and analyzing the relevant literature, this review highlights the effectiveness of different algorithms and their practical applications in enhancing the security of online commerce platforms. More specifically, five techniques were assessed on both real and synthetic datasets: Logistic Regression, Naive Bayes, Random Forest, Artificial Neural Network, and two combined models (Logistic Regression & Naive Bayes, and Artificial Neural Network & Random Forest). The findings indicate that Random Forest performed better than other algorithms in the decision tree family, attributed to its ability to balance precision and recall effectively. However, limitations such as using a single dataset and the computational complexity of some models were noted. This review provides insights for practitioners on selecting appropriate detection models and outlines approaches to address current limitations through future work. Addressing these limitations could involve using more diverse datasets, optimizing computational efficiency, and exploring advanced ensemble methods and neural network architectures.

Deep Learning in Cybersecurity: A Hybrid BERT–LSTM Network for SQL Injection Attack Detection

In the past decade, cybersecurity has become increasingly significant, driven largely by the increase in cybersecurity threats. Among these threats, SQL injection attacks stand out as a particularly common method of cyber attack. Traditional methods for detecting these attacks mainly rely on manually defined features, making these detection outcomes highly dependent on the precision of feature extraction. Unfortunately, these approaches struggle to adapt to the increasingly sophisticated nature of these attack techniques, thereby necessitating the development of more robust detection strategies. This paper presents a novel deep learning framework that integrates Bidirectional Encoder Representations from Transformers (BERT) and Long Short-Term Memory (LSTM) networks, enhancing the detection of SQL injection attacks. Leveraging the advanced contextual encoding capabilities of BERT and the sequential data processing ability of LSTM networks, the proposed model dynamically extracts word and sentence-level features, subsequently generating embedding vectors that effectively identify malicious SQL query patterns. Experimental results indicate that our method achieves accuracy, precision, recall, and F1 scores of 0.973, 0.963, 0.962, and 0.958, respectively, while ensuring high computational efficiency.

SQL Injection Detection using Machine Learning: A Review

SQL injection attacks are critical security vulnerability exploitation in web applications, posing risks to data, if successfully executed, allowing attackers to gain unauthorised access to sensitive data. Due to the absence of a standardised structure, traditional signature-based detection methods face challenges in effectively detecting SQL injection attacks. To overcome this challenge, machine learning (ML) algorithms have emerged as a promising approach for detecting SQL injection attacks. This paper presents a comprehensive literature review on the utilisation of ML techniques for SQL injection detection. The review covers various aspects, including dataset collection, feature extraction, training, and testing, with different ML algorithms. The studies included in the review demonstrate high levels of accuracy in detecting attacks and reducing false positives.

Detecting SQL injection attacks by binary gray wolf optimizer and machine learning algorithms

SQL injection is one of the important security issues in web applications because it allows an attacker to interact with the application's database. SQL injection attacks can be detected using machine learning algorithms. The effective features should be employed in the training stage to develop an optimal classifier with optimal accuracy. Identifying the most effective features is an NP-complete combinatorial optimization problem. Feature selection is the process of selecting the training dataset's smallest and most effective features. The main objective of this study is to enhance the accuracy, precision, and sensitivity of the SQLi detection method. In this study, an effective method to detect SQL injection attacks has been proposed. In the first stage, a specific training dataset consisting of 13 features was prepared. In the second stage, two different binary versions of the Gray-Wolf algorithm were developed to select the most effective features of the dataset. The created optimal datasets were used by different machine learning algorithms. Creating a new SQLi training dataset with 13 numeric features, developing two different binary versions of the gray wolf optimizer to optimally select the features of the dataset, and creating an effective and efficient classifier to detect SQLi attacks are the main contributions of this study. The results of the conducted tests indicate that the proposed SQL injection detector obtain 99.68% accuracy, 99.40% precision, and 98.72% sensitivity. The proposed method increases the efficiency of attack detection methods by selecting 20% of the most effective features.

SQL Injection Detection Using RNN Deep Learning Model

SQL injection attacks are a common type of cyber-attack that exploit vulnerabilities in web applications to access databases through malicious SQL queries. These attacks pose a serious threat to the security and integrity of web applications and their data. The existing methods for detecting SQL injection attacks are based on predefined rules that can be easily circumvented by sophisticated attackers. Therefore, there is a need for a more robust and effective method for detecting SQL injection attacks. In this research, we propose a novel method for detecting SQL injection attacks using recurrent neural networks (RNN), which are a type of deep learning model that can capture the syntax and semantic features of SQL queries. We train an RNN model on a dataset of benign and malicious SQL queries, and use it to classify queries as either benign or malicious. We evaluate our method on a benchmark dataset and compare it with the existing rule-based methods. Our experimental results show that our method achieved high accuracy and outperformed the rule-based methods for detecting SQL injection attacks. Our research contributes to the field of web application security by providing a new and effective solution for protecting web applications from SQL injection attacks using deep learning. Our method has both practical and theoretical implications, as it can be easily integrated into existing web application security frameworks to provide an additional layer of protection against SQL injection attacks, and it can also advance the understanding of how deep learning models can be applied to natural language processing tasks such as SQL query analysis.

Deep Learning-Based Detection Technology for SQL Injection Research and Implementation

Amid the incessant evolution of the Internet, an array of cybersecurity threats has surged at an unprecedented rate. A notable antagonist within this plethora of attacks is the SQL injection assault, a prevalent form of Internet attack that poses a significant threat to web applications. These attacks are characterized by their extensive variety, rapid mutation, covert nature, and the substantial damage they can inflict. Existing SQL injection detection methods, such as static and dynamic detection and command randomization, are principally rule-based and suffer from low accuracy, high false positive (FP) rates, and false negative (FN) rates. Contemporary machine learning research on SQL injection attack (SQLIA) detection primarily focuses on feature extraction. The effectiveness of detection is heavily reliant on the precision of feature extraction, leading to a deficiency in tackling more intricate SQLIA. To address these challenges, we propose a novel SQLIA detection approach harnessing the power of an enhanced TextCNN and LSTM. This method begins by vectorizing the samples in the corpus and then leverages an improved TextCNN to extract local features. It then employs a Bidirectional LSTM (Bi-LSTM) network to decipher the sequence information inherent in the samples. Given LSTM’s modest effectiveness for relatively long sequences, we further integrate an attention mechanism, reducing the distance between any two words in the sequence to one, thereby enhancing the model’s effectiveness. Moreover, pre-trained word vector features acquired via BERT for transfer learning are incorporated into the feature section. Comparative experimental results affirm the superiority of our deep learning-based SQLIA detection approach, as it effectively elevates the SQLIA recognition rate while reducing both FP and FN rates.

Deep Learning Architecture for Detecting SQL Injection Attacks Based on RNN Autoencoder Model

SQL injection attacks are one of the most common types of attacks on Web applications. These attacks exploit vulnerabilities in an application’s database access mechanisms, allowing attackers to execute unauthorized SQL queries. In this study, we propose an architecture for detecting SQL injection attacks using a recurrent neural network autoencoder. The proposed architecture was trained on a publicly available dataset of SQL injection attacks. Then, it was compared with several other machine learning models, including ANN, CNN, decision tree, naive Bayes, SVM, random forest, and logistic regression models. The experimental results showed that the proposed approach achieved an accuracy of 94% and an F1-score of 92%, which demonstrate its effectiveness in detecting QL injection attacks with high accuracy in comparison to the other models covered in the study.

Vulnerability Detection With K-Nearest Neighbor and Naïve Bayes Method using Machine Learning

In this day and age, the use of the Internet has increased. SQL injection is a serious security threat on the Internet for various dynamic websites. As the use of the Internet for various online services increases, so make the security threats that exist on the Web. SQL injection attacks are one of the most serious security vulnerabilities on the Web. Most of these vulnerabilities are caused by a lack of input validation and the use of SQL parameters. SQLMap is an application from the Kali Linux operating system that is useful for injecting data on a website by using the features available in this application. In this paper, author conducts a security assessment to detect attacks on a website, more precisely to detect SQL Injection attacks, using the K-Nearest Neighbor method and naïve bayes. The results obtained are that the website being tested has SQL Injection vulnerabilities, and the K-Nearest Neighbor method is the best method for this case because it has an accuracy of 94.2%. In comparison, the Naïve Bayes method has an accuracy of 80%.

SDSIOT: An SQL Injection Attack Detection and Stage Identification Method Based on Outbound Traffic

An SQL Injection Attack (SQLIA) is a major cyber security threat to Web services, and its different stages can cause different levels of damage to an information system. Attackers can construct complex and diverse SQLIA statements, which often cause most existing inbound-based detection methods to have a high false-negative rate when facing deformed or unknown SQLIA statements. Although some existing works have analyzed different features for the stages of SQLIA from the perspectives of attackers, they primarily focus on stage analysis rather than different stages’ identification. To detect SQLIA and identify its stages, we analyze the outbound traffic from the Web server and find that it can differentiate between SQLIA traffic and normal traffic, and the outbound traffic generated during the two stages of SQLIA exhibits distinct characteristics. By employing 13 features extracted from outbound traffic, we propose an SQLIA detection and stage identification method based on outbound traffic (SDSIOT), which is a two-phase method that detects SQLIAs in Phase I and identifies their stages in Phase II. Importantly, it does not need to analyze the complex and diverse malicious statements made by attackers. The experimental results show that SDSIOT achieves an accuracy of 98.57% for SQLIA detection and 94.01% for SQLIA stage identification. Notably, the accuracy of SDSIOT’s SQLIA detection is 8.22 percentage points higher than that of ModSecurity.

Neural network based single index evaluation for SQL injection attack detection in health care data

In recent years, there are a lot of security risks in the network, and there is the combination intersection between the computer network security problems and security evaluation. The scale of computer network is very large with vast information, so there are many loopholes in the system network. At present, many have established a computer network security evaluation system to monitor the network security vulnerabilities, viruses, and defects in healthcare. However, many places simply analyzed the risk assessment of network security, but there is no assessment of network security situation. For the network security evaluation system, there is no complete evaluation system of network information security. Therefore, a network security evaluation system must be constructed to develop an effective and practical simulation model of computer network security evaluation. Through the simulation model, the effect of network security can be improved. Since the reform and opening up, the simulation of computer network security evaluation in our country is a new subject. It can directly study the network security evaluation, build a network security evaluation model, and study the network security in detail. In the computer network simulation system, it can analyze, study, design, and plan various stages, so as to play an important role.

Toward an SDN-Based Web Application Firewall: Defending against SQL Injection Attacks

Web attacks pose a significant threat to enterprises, as attackers often target web applications first. Various solutions have been proposed to mitigate and reduce the severity of these threats, such as web application firewalls (WAFs). On the other hand, software-defined networking (SDN) technology has significantly improved network management and operation by providing centralized control for network administrators. In this work, we investigated the possibility of using SDN to implement a firewall capable of detecting and blocking web attacks. As a proof of concept, we designed and implemented a WAF to detect a known web attack, specifically SQL injection. Our design utilized two detection methods: signatures and regular expressions. The experimental results demonstrate that the SDN controller can successfully function as a WAF and detect SQL injection attacks. Furthermore, we implemented and compared ModSecurity, a traditional WAF, with our proposed SDN-based WAF. The results reveal that our system is more efficient in terms of TCP ACK latency, while ModSecurity exhibits a slightly lower overhead on the controller.

Enhancing the Performance of SQL Injection Attack Detection through Probabilistic Neural Networks

SQL injection attack is considered one of the most dangerous vulnerabilities exploited to leak sensitive information, gain unauthorized access, and cause financial loss to individuals and organizations. Conventional defense approaches use static and heuristic methods to detect previously known SQL injection attacks. Existing research uses machine learning techniques that have the capability of detecting previously unknown and novel attack types. Taking advantage of deep learning to improve detection accuracy, we propose using a probabilistic neural network (PNN) to detect SQL injection attacks. To achieve the best value in selecting a smoothing parament, we employed the BAT algorithm, a metaheuristic algorithm for optimization. In this study, a dataset consisting of 6000 SQL injections and 3500 normal queries was used. Features were extracted based on tokenizing and a regular expression and were selected using Chi-Square testing. The features used in this study were collected from the network traffic and SQL queries. The experiment results show that our proposed PNN achieved an accuracy of 99.19% with a precision of 0.995%, a recall of 0.981%, and an F-Measure of 0.928% when employing a 10-fold cross-validation compared to other classifiers in different scenarios.

SQL Injection Attack: Quick View

SQL injection is a type of security vulnerability that occurs in database-driven web applications where an attacker injects malicious code into the application to gain unauthorized access to sensitive information. This paper aims to provide a comprehensive and systematic review of the existing methods for preventing and detecting SQL injection attacks. The review covers a range of techniques, including input validation, parameterized queries, and intrusion detection systems, as well as the advantages and disadvantages of each method. The most common prevention techniques include input validation, parameterized queries, and stored procedures, while the most common detection techniques include intrusion detection systems (IDS), honeypots, and signature-based detection. The choice of method will depend on the specific requirements of the organization and the level of security required. Still, a combination of prevention and detection methods is likely to be the most effective way to secure web applications against SQL injection attacks. The paper concludes that SQL injection attacks continue to be a significant security threat to web applications, and it is essential for organizations to implement effective prevention and detection methods to secure their web applications against SQL injection attacks.

Deep Learning Technique-Enabled Web Application Firewall for the Detection of Web Attacks.

New techniques and tactics are being used to gain unauthorized access to the web that harm, steal, and destroy information. Protecting the system from many threats such as DDoS, SQL injection, cross-site scripting, etc., is always a challenging issue. This research work makes a comparative analysis between normal HTTP traffic and attack traffic that identifies attack-indicating parameters and features. Different features of standard datasets ISCX, CISC, and CICDDoS were analyzed and attack and normal traffic were compared by taking different parameters into consideration. A layered architecture model for DDoS, XSS, and SQL injection attack detection was developed using a dataset collected from the simulation environment. In the long short-term memory (LSTM)-based layered architecture, the first layer was the DDoS detection model designed with an accuracy of 97.57% and the second was the XSS and SQL injection layer with an obtained accuracy of 89.34%. The higher rate of HTTP traffic was investigated first and filtered out, and then passed to the second layer. The web application firewall (WAF) adds an extra layer of security to the web application by providing application-level filtering that cannot be achieved by the traditional network firewall system.

SQL injection attack detection in network flow data

SQL injections rank in the OWASP Top 3. The literature shows that analyzing network datagrams allows for detecting or preventing such attacks. Unfortunately, such detection usually implies studying all packets flowing in a computer network. Therefore, routers in charge of routing significant traffic loads usually cannot apply the solutions proposed in the literature. This work demonstrates that detecting SQL injection attacks on flow data from lightweight protocols is possible. For this purpose, we gathered two datasets collecting flow data from several SQL injection attacks on the most popular database engines. After evaluating several machine learning-based algorithms, we get a detection rate of over 97% with a false alarm rate of less than 0.07% with a Logistic Regression-based model.

Semantic Query-Featured Ensemble Learning Model for SQL-Injection Attack Detection in IoT-Ecosystems

Structured query language (SQL) has emerged as one of the most used databases, serving an array of Internet-of-Things (IoTs)-enabled services including web-transactions, grid networks, industrial activity log and proactive decision systems, smart-home, financial transactions, business communication etc. With high pace increase in SQL-driven IoT applications, the threat of SQL-injection attacks (SQLIAs) at the middleware layer has increased significantly. To address such issues, machine learning-based SQLIA-prediction systems are proposed; however, majority of the existing methods are found limited in terms of intrusion detection accuracy because of their complete-reliance on structural features and inferior learning model(s). On the contrary, intruders these days intrude the system by mimicking the normal queries and hence confuses most of the classical learning-based methods. To alleviate such problems, this article emphasizes on exploiting semantic features along with the state-of-art highly robust computing environment. We proposed a robust semantic query-featured ensemble learning model for SQLIA prediction. Unlike classical (query's) template-matching or term-assessment-based methods, our proposed SQLIA-prediction model exploits latent semantic features from large SQL-queries to train an ensemble learning model that classifies each query as the normal query or the SQLIA query. Functionally, it performs preprocessing over large set of SQL-queries using count-vectorizer and stopping word removal. Subsequently, it applies Word2Vec feature extraction method over each query using continuous bag of words (CBOW) and N-skip gram (SKG) algorithms, which obtained CBOW and SKG semantic features from each SQL-query. The extracted features were processed for data resampling so as to alleviate the problem of class-imbalance and skewness. To alleviate redundant computation, two feature selection algorithms named Mann-Whitney significance predictor test and principal component analysis were applied over the resampled features. Moreover, to eliminate over-fitting and convergence problem, Min-Max normalization was performed over the selected features which were later processed for learning using a state-of-art robust heterogeneous ensemble learning model. Unlike standalone classifier-based SQLIA, the proposed learning-model employed a set of nine base classifiers designed to serve maximum voting ensemble-based prediction. The proposed ensemble-learning method classified each SQL-query as the normal-query or the SQLIA-query. Simulation results affirmed superiority of the proposed SQLIA prediction model in terms of accuracy (98%), F-Score (0.989), AUC (0.999) signifying its efficacy toward real-world SQL-driven IoT-ecosystems.

A Novel Approach for Detecting SQL Injection Attacks Using Snort

A Novel Approach for Detecting SQL Injection Attacks Using Snort

Review of SQLI detection strategies using machine learning

Various platforms and web apps to deliver material via the Internet are becoming more widespread. Web-based technologies accept and store sensitive information from users. Because of their Internet connectivity, these systems and the databases they link to are vulnerable to various information security vulnerabilities. The most dangerous threats are denial of service (DoS) and SQL injection assaults. SQL Injection attacks are at the top of the list for web-based systems. In this type of attack, the perpetrator will take sensitive and classified information that might hurt a firm or enterprise. Depending on the conditions, the corporation may incur financial losses, have private information disclosed, and have its stock market value drop. This work uses machine learning-based classifiers such as MLP, Support Vector Machine, Logistic Regression, Naive Bayes, and Decision Tree to identify and detect SQL Injection attacks. For the SQLI dataset learning strategies, we examined all five algorithms using the Confusion Matrix, F1 Score, and Log Loss. We discuss the benefits and drawbacks of the proposed AI-based SQLI techniques. Finally, we talk about making SQLI reach its full potential through more research in the coming years.

Методология построения нейронной нечеткой сети в области информационной безопасности

This paper proposes the use of hybrid models based on neural networks and fuzzy systems to build intelligent intrusion detection systems based on the theory of fuzzy rules. The presented system will be able to generate rules based on the results using fuzzy logic neurons. To avoid oversaturation and assist in determining the necessary network topology, training models based on extreme learning machine and regularization theory will be used to find the most significant neurons. In this paper, a type of SQL injection cyberattack is considered, which actively exploits errors in systems that communicate with the database via SQL commands, and for this reason is considered a kind of straightforward attack. The fuzzy neural network architecture used in detecting SQL injection attacks is a multi-component structure. The first two layers of the model are considered as a fuzzy inference system capable of extracting knowledge from data and transforming it into fuzzy rules. These rules help build automated systems for detecting SQL injection attacks. The third layer consists of a simple neuron that has an activation function called a leaky ReLU. The first layer consists of fuzzy neurons, the activation functions of which are Gaussian membership functions of fuzzy sets, defined in accordance with the partitioning of the input variables. The technique uses the concept of a simple linear regression model to solve the problem of choosing the best subsets of neurons. To perform model selection, the paper used the widely used least angular regression (LARS) algorithm.

Анализ обнаружения атаки на базе SQL-инъекции с помощью импульсной искусственной нейронной сети

This article presents the results of testing to create a specialized system that helps prevent cyberattacks, thus popularizing the construction of intelligent applications. Based on the results obtained, it can be argued that the tests carried out are satisfactory. The mathematical basis for building a neural network model is the HESADM model (Hybrid Artificial Intelligence Framework). The presented system allows you to form a set of rules using fuzzy logical neurons. This paper presents an approach to the formation of a fuzzy neural network used for detecting SQL injection attacks. The methodology used in this paper is an impulse artificial neural network (SANN), which uses an evolving neural network system (eCOS) and a multi-layer approach of an impulse artificial neural network to classify the exact type of intrusion or network anomaly with minimal computational potential. The impulse artificial neural system forms itself continuously, adapting to the input data, being in a functioning or not state, being under the supervision of an administrator. This system finds application to several other complex problems of the real world, proving its efficiency, including in the field of information security. The considered model is a hybrid evolving pulse anomaly detection model (HESADM), which works on impulses that occur in the system, while neurons are used to monitor the algorithm using a single training pass. In the system, traffic-oriented data is used by importing classes that use variable encoding. The data used is obtained by converting the real characteristics of network traffic into certain time stamps.