Request-Response Network Traffic Packets: Enhancing SQL Injection Attack Detection with a Transformer-Based Model

SQL Injection Attacks (SQLIA) continue to be a major factor threatening database security. With the rise of machine learning and deep learning technologies, we now have more advanced tools to identify complex features and relationships, making their performance in SQLIA detection significantly surpass traditional methods. However, some attackers use obfuscation techniques to try to avoid these detection mechanisms. Notably, most of the existing SQLIA datasets focus too much on the attack's network packets. We propose that incorporating the corresponding response packets will provide richer contextual information for detection, potentially further optimizing SQLIA detection results. Based on this idea, we construct a new dataset over 30,000 entries that integrates the request packets of SQL injection attacks and their corresponding response packets. With this dataset, we successfully train a SQLIA detection model based on the Transformer architecture. After comparative experiments with other mainstream models, the results show that our model achieved an accuracy of 99.92%, significantly better than other methods. At the end of the article, we also delve into future research directions.