Enhancing SQL Injection Detection and Prevention Using Generative Models

2025-02-07

AI Summary

SQL injection (SQLi) remains a critical threat to web application security; conventional signature-based and static machine learning approaches struggle against zero-day and obfuscated attacks. This paper proposes a generative-model-based adaptive detection framework that uniquely integrates a variational autoencoder (VAE), a conditional Wasserstein GAN with gradient penalty (CWGAN-GP), and a U-Net architecture to collaboratively synthesize high-fidelity, diverse malicious and benign SQL query samples—enabling data augmentation–driven dynamic detection. Coupled with a lightweight classifier, the framework achieves low false positive and false negative rates while significantly improving detection accuracy and robustness against previously unseen SQLi variants. Experimental results demonstrate superior detection accuracy over traditional methods and rapid adaptability to emerging SQLi obfuscation techniques.

Technology Category

• Machine Learning: Adversarial Learning & Robustness
• Computer Vision: Generative Adversarial Networks (GANs) for Vision
• Natural Language Processing: Code Generation / Program Synthesis from Natural Language

Application Category

• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking
• Web Mining and Content Analysis: Large pretrained models with web data

Abstract

SQL Injection (SQLi) continues to pose a significant threat to the security of web applications, enabling attackers to manipulate databases and access sensitive information without authorisation. Although advancements have been made in detection techniques, traditional signature-based methods still struggle to identify sophisticated SQL injection attacks that evade predefined patterns. As SQLi attacks evolve, the need for more adaptive detection systems becomes crucial. This paper introduces an innovative approach that leverages generative models to enhance SQLi detection and prevention mechanisms. By incorporating Variational Autoencoders (VAE), Conditional Wasserstein GAN with Gradient Penalty (CWGAN-GP), and U-Net, synthetic SQL queries were generated to augment training datasets for machine learning models. The proposed method demonstrated improved accuracy in SQLi detection systems by reducing both false positives and false negatives. Extensive empirical testing further illustrated the ability of the system to adapt to evolving SQLi attack patterns, resulting in enhanced precision and robustness.

Problem

• Enhance SQL Injection detection accuracy
• Adapt to evolving SQLi attack patterns
• Reduce false positives and negatives

Innovation

• Generative models enhance SQLi detection
• VAE and CWGAN-GP generate synthetic queries
• U-Net improves SQLi detection accuracy