SQLiDDS: SQL Injection Detection Using Query Transformation and Document Similarity

The ubiquity of Web applications has led to an increased focus on the development of attacks targeting these applications. One particular type of attack that has recently become prominent is the SQL injection attack. SQL injection attacks can potentially result in unauthorized access to confidential information stored in a backend database. In this paper we describe an anomaly based approach which utilizes the character distribution of certain sections of HTTP requests to detect previously unseen SQL injection attacks. Our approach requires no user interaction, and no modification of or access to, either the backend database or the source code of the web application itself. Our practical results suggest that the model proposed in this paper is superior to existing models at detecting SQL injection attacks. We also evaluate the effectiveness of our model at detecting different types of SQL injection attacks.

SQL injection (SQLi) attacks are one of the oldest and most serious security threats, consistently ranking among the top ten critical web security risks. Traditional defense mechanisms against SQL injection predominantly use blacklists to disallow common injection characters or terms. However, the major challenge for these systems is to create a comprehensive list of potential SQLi characters, terms, and multi-terms that encompass various types of SQLi attacks (time-based, error-based, etc.), taking into account various SQL datasets (such as MySQL, Oracle, and NoSQL). Recently, some research studies have concentrated on feature learning from SQL queries by applying some well-known deep architectures to detect SQLi attacks. Motivated by a similar objective, this research introduces a novel deep learning-based SQLi detection system named “Bidirectional LSTM-CNN based on Multi-View Consensus” (MVC-BiCNN). The proposed method implements a pre-processing step that generates multiple views from SQL data by semantically encoding SQL statements into their corresponding SQL tags. By utilizing two different main layers, which are bidirectional long short-term memory (LSTM) and convolutional neural network (CNN), the proposed method learns a joint latent space from multi-view representations. In the detection phase, the proposed method yields separate predictions for each representation and assesses whether the query constitutes an SQLi attack based on a consensus function’s output. Moreover, Interpretable Model-Agnostic Annotations (LIME), one of the methods of Explainable Artificial Intelligence (XAI), is employed for the purpose of interpreting the model’s results and analyzing the SQL injection (SQLi) inputs. The experimental results demonstrate that MVC-BiCNN outperforms the baseline methods, yielding 99.96% detection rate.

SQL injection is a type of attacks used to gain, manipulate, or delete information in any data-driven system whether this system is online or offline and whether this system is a web or non -web -based. It is distinguished by the multiplicity of its performing methods, so defense techniques could not detect or prevent such attacks. The main objective of this paper is to create a reliable and accurate hybrid technique that secure systems from being exploited by SQL injection attacks. This hybrid technique combines static and runtime SQL queries analysis to create a defense strategy that can detect and prevent various types of SQL injection attacks. To evaluate this suggested technique, a large set of SQL queries have been executed through a simulation that had been developed. The results indicate that the suggested technique is reliable and more effective in capturing more SQL injection types compared to other SQL injection detection methods.

Database driven web application are threaten by SQL Injection Attacks (SQLIAs) because this type of attack can compromise confidentiality and integrity of information in databases. Actually, an attacker intrudes to the web application database and consequently, access to data. For stopping this type of attack different approaches have been proposed by researchers but they are not enough because most of implemented approaches cannot stop all type of attacks. In this paper all type of SQL injection attack and also different techniques which can detect or prevent them are presented. Finally we evaluate these approaches against all types of SQL injection attacks.

Objectives: SQL Injection Attack (SQLIA) is a frequent and a severe security issue in the web applications. In SQLIA, hacker can obtain the benefit of poor input validation and weak coded web application. Due to the successful execution of a SQLIA, integrity and confidentiality of data are lost which results in the degrading organization’s market value. This paper gives a valuable analysis of various types of SQLIAs, methods and mechanisms. It also explores various detection and prevention techniques. Methods/Analysis: A rigorous survey has been conducted and consequently, comparative analysis of various detection and prevention techniques is done with respect to various types of attacks. In current research various pattern matching algorithms for the detection and prevention of SQLIA are analyzed and few are tested. Findings: Comparative analysis of Boyer Moore pattern matching algorithm is done with Naive String pattern matching algorithm. The time and memory consumption taken by both the algorithms has been analyzed. The results show that Boyer Moore is more efficient to detect and prevent the SQLIAs as compared to Naive string. Novelty/Improvement: In future it aims to propose an algorithm which will enhance in terms of efficiency and resource usage. The approach needs to be implemented for every pattern matching algorithm to find the best solution regarding detection and prevention of SQLIA.

SQL Injection Attack (SQLIA) has been consistently ranked among the top security threats against web applications for more than a decade. Nowadays, attackers use sophisticated tools to launch automated injection attacks. The problem of prevention and detection of SQLIA has been long attended by the research community, but hardly any solution exists for protecting multiple websites in a shared hosting environment. In this paper, we present a novel method to detect malicious queries using a twin Hidden Markov Model (HMM) ensemble and validate it with large set of benign and malicious queries collected from five sample web applications written in PHP and MySQL. Following the Multiple Classifier System (MCS) paradigm, we combine the output of individual HMMs to arrive at the final decision, which provides better accuracy and lower false alarms. The system is intended to work at the database firewall layer, therefore it can protect multiple web applications hosted on a shared server. The initial experimental results are very encouraging and indicate that the approach can effectively identify wide varieties of SQLIA with negligible impact on performance. The technique can be easily ported to other languages and database platforms without requiring major modifications.

As web applications become increasingly popular for offering data and services among businesses and organizations they also become more susceptible to security risks. Many organizations rely today on Web Vulnerability Scanners (WVSs) to identify vulnerabilities in their web applications. However, one of the most prevalent types of web application vulnerabilities, SQL Injections (SQLi), can often go undetected by WVSs. OWASP ZAP is an open-source web vulnerability scanner that allows security professionals to develop rules to improve vulnerability detection capability. In this paper, a new method is proposed to improve the detection capability of OWASP ZAP for SQLi. We aim to accurately detect the four major types of SQLi: Error-based, Union-based, Time-based blind, and Authentication Bypass. We implemented this new method using OWASP ZAP detection policies. The method was tested against two benchmark vulnerable web applications, Mutillidae and WebGoat, and was shown to significantly improve the detection of SQL injection attacks.

Web applications and databases continue to face grave danger from SQL injection attacks, which can result in unauthorized access, data modification, and system compromise.This report discusses the methods attackers use to exploit SQL injection vulnerabilities and emphasizes the dangers of successful attacks, such as data leaks and system compromise.This research proposes a comprehensive system for detecting SQL injection attacks using concatenated Input Validation and Parsing Method (CIVP).The site used as experimental material is the Multimedia and Journal Services Site.Based on the results of forensic analysis on the Journal Services Site, there were several attacks in cyberspace, including using SQLMAP and Python.The system created has successfully detected SQL injection attacks.Based on the test results, it was found that the use of the method proposed in this study succeeded in making processing time 15.2% more efficient.Experiments carried out with the method proposed in this study succeeded in increasing the attack detection accuracy from 96-97% to 99.5% with a p-value of 0.008446.

In the evolving landscape of cybersecurity, timely identification of software vulnerabilities plays a vital role in safeguarding digital assets. This paper introduces a full-stack web application designed to provide a centralized platform for vulnerability assessment. Developed using React.js and Tailwind CSS on the frontend and Python-based APIs on the backend, the system integrates key security features such as file and URL scanning through VirusTotal, detection of SQL injection and XSS attacks using OWASP ZAP, CVE information retrieval via the NVD API, and static code analysis for Python, Java, and C++ using tools like Bandit, SpotBugs, and CPPcheck. Additionally, it leverages the Nikto scanner to detect web server vulnerabilities. The platform delivers real-time scan results through an intuitive interface, making it accessible to both technical and non-technical users. By combining multiple open-source tools into a single application, this project enhances the detection and mitigation of security risks in web environments. The platform includes real-time packet capturing and endpoint monitoring features, offering a network-layer perspective on potential threats. Its modular architecture and asynchronous API handling ensure fast, intelligent responses across all tools. These advancements enhance both detection accuracy and user experience. Together, they make Cyber Sentinel a complete and adaptive security solution.

In computer security terminologies, SQL Injection Attacks (SQLIAs) are attacks that pose a security threats to web applications by manipulating, modifying, retrieving or destructing sensitive information underlying database server through web applications. This type of attacks could compromise data confidentiality, integrity and availability of database systems of the online applications. Although many researchers and developers were focusing on preventing this type of attack, and proposing techniques to overcome this problem, those methods either fails in correctly addressing this type of attacks or have some limitation on preventing all types of SQLIAs.

With the emergence and popularity of web application, threats related to web applications has increased to large extent. Among many other web applications threats Structured Query Language Injection Attack (SQLIA) is the dominant in its use due to its ability to access the data. Many solutions are proposed in this regard that has success in specific conditions. The proposed model is based on the dynamic analyzer model. The proposed model also has certain advantages like wide applicability, fast response time, coverage to large number of techniques of SQL Injections (SQLI) and efficient in term of resource usage.

SQL injection is one of the important security issues in web applications because it allows an attacker to interact with the application's database. SQL injection attacks can be detected using machine learning algorithms. The effective features should be employed in the training stage to develop an optimal classifier with optimal accuracy. Identifying the most effective features is an NP-complete combinatorial optimization problem. Feature selection is the process of selecting the training dataset's smallest and most effective features. The main objective of this study is to enhance the accuracy, precision, and sensitivity of the SQLi detection method. In this study, an effective method to detect SQL injection attacks has been proposed. In the first stage, a specific training dataset consisting of 13 features was prepared. In the second stage, two different binary versions of the Gray-Wolf algorithm were developed to select the most effective features of the dataset. The created optimal datasets were used by different machine learning algorithms. Creating a new SQLi training dataset with 13 numeric features, developing two different binary versions of the gray wolf optimizer to optimally select the features of the dataset, and creating an effective and efficient classifier to detect SQLi attacks are the main contributions of this study. The results of the conducted tests indicate that the proposed SQL injection detector obtain 99.68% accuracy, 99.40% precision, and 98.72% sensitivity. The proposed method increases the efficiency of attack detection methods by selecting 20% of the most effective features.

The purpose of this article is to propose a hybrid deep learning framework for the effective detection of SQL injection (SQLi) attacks in database-driven web applications. The proposed framework integrates supervised and unsupervised learning techniques with honeypot-assisted intelligence collection to address the limitations of existing SQLi detection systems, which are largely reactive and primarily focused on classification accuracy without adaptive intelligence mechanisms. The architecture combines a CNN–LSTM pathway for supervised pattern recognition with an autoencoder-based anomaly detection pathway trained on benign queries. Outputs from both pathways are fused through a learned fusion layer to improve robustness against both known and previously unseen attack variants. Queries classified as malicious are redirected to a low-interaction database honeypot, enabling structured capture of attack payloads and behavioural artefacts for security intelligence generation. Experimental evaluation conducted on a curated dataset of approximately 50,000 SQL queries demonstrates strong detection performance, achieving an average accuracy of 99.2 per cent, precision of 98.9 per cent, recall of 99.0 per cent, and an AUC of 0.99 across multiple runs. Although the architecture supports closed-loop retraining using honeypot-captured data, this study focuses on offline performance and initial intelligence acquisition, with adaptive retraining identified as future work. The results demonstrate that integrating supervised learning, anomaly detection, and deception mechanisms provides a robust foundation for adaptive SQLi defence systems.

SQL Injection Attacks Represent Two-Third of All Web App Attacks. An estimated 25% of breaches last year started with an SQL Injection attack. SQL injection is a popular web attack and has been a challenging matter for network security; SQL causes financial losses worldwide as well as user data offensive. SQL injection detection has become a hot topic recently. How to defense against SQL injection attacks effectively has drawn the attention of web security professionals and researchers. The objective of this paper was to introduce a model that could identify SQL injection attacks effectively based on entry data. We built a machine learning model based on a logistic regression algorithm to detect SQL injection attacks based on historical web log data, the dataset was collected from an online repository website, containing 4201 entries. The model achieved an accuracy of 0.93, sensitivity 0.78, specificity 0.81, and precision of 0.98. Therefore, beyond accuracy, other performance metrics were considered for optimal model design. Using machine learning techniques for SQL attack detection is very useful and can be used even in real-time applications.

Day after day, SQL Injection (SQLI) attack is consistently proliferating across the globe. According to Open Web Application Security Project (OWASP) Top Ten Cheat Sheet-2014, SQLI is at top in the list of online attacks. The cause of spread of SQLI is thought to be Unsecure Software Engineering. The Software Development process itself appears to look at security as an add-on to be checked and deployed towards the end of the software development lifecycle which leads to vulnerabilities in web applications. This paper is an attempt to integrate security in early stages of SDLC i.e. in design phase to mitigate SQLI vulnerability. How SQLI attack happens is illustrated. Threat Modeling is performed to mitigate the SQLI vulnerability.