A Zero-Sum Game Theoretic Framework for SQL Injection Attacks and Self-defense

SQL injection attacks are one of the most destructive attack vectors in the Web application layer. Although protection technologies have been constantly evolving, the cost of a single attack has been compressed, leading to the structural imbalance between attack and defense costs. Current research lacks game-theoretic models for SQL injection attack risks. This paper presents a zero-sum game model for SQL injection attacks to analyze the strategic interactions and equilibrium states among enterprises, attackers, and insurance companies. It considers single-node, associated-node, and supplier-enterprise scenarios. The model reveals that network effects intensify risk transmission and core suppliers play a key role in global risks. Numerical analysis verifies the impact of network structure on equilibrium strategies. This study offers a framework for dynamic defense decisions against SQL injection attacks, insurance product design, and regulatory policies.