A Signature and NLP-based Network Traffic Detection Model For SQL Injections for Enhancing Web Security

The paper addresses the persistent threat of Structured Language Query Injection (SQLI) attacks on web applications and the proposed solution. It introduces SQLI and its history of being one of the most prominent cyber-attacks, in addition to identifying the current detection methods and their limitations. The proposed solution integrates a machine learning (ML) technique and a layered approach to create a robust model capable of identifying SQLI attempts. The model’s methodology includes multi-layer signature-based and Natural Language Processing (NLP) pattern-based approaches to analyze queries and distinguish between benign and malicious ones. Signature-based approach provides a quick analysis without requiring much compute, while the NLP-based approach is smarter and more granular. The model aims to adapt to evolving cyber threats reliably through training on diverse datasets, constant updating, and achieving high accuracies. The tool is built in a way that embodies an open-source shell to allow maximum flexibility in each use case, as well as being scalable to allow for seamless adoption to a variety of infrastructural demands. Ethical considerations ensure adherence to standards in data handling while acknowledging limitations such as the evolving nature of attacks and dependency on dataset quality. This paper aims to contribute to the ongoing field of SQLI analysis and detection by offering a unique and proactive combination of mechanisms.