Semantic-Based SQL Injection Detection Method

SQL Injection Attack (SQLIA) is one of the main attack vectors against databases, which exploits a vulnerability that user-input data is executed in the database to maliciously concatenate SQL query statements for the purpose of illegally querying the database, posing a significant threat to web security. Due to the fact that there are many similarities between SQL injection statements and normal HTTP requests in terms of numerous identical fields, directly matching keywords by computers can result in a considerable amount of misjudgment and missed judgments. Therefore, this article proposes a semantic-based SQL injection attack detection method that allows computers to determine the semantics of the statement to determine whether it is a normal HTTP request or a SQL injection attack statement. This article analyzes the similarities and differences between attack statements at various stages of SQL injection and normal HTTP requests, and proposes a preprocessing method that can extract effective attack keywords based on this. Additionally, combined with natural language processing, word2vec, and a support vector machine (SVM) classification algorithm, a set of semantic-based SQL injection attack detection methods were constructed. These methods were tested using experiments on a local CMS with known SQL injection vulnerabilities. The experimental results demonstrate that compared to directly using traditional SQL injection attack detection methods based on machine learning algorithms such as TF-IDF or word2vec, this method has significant improvement in the detection results.