# Deep Learning-Based Detection Technology for SQL Injection Research and Implementation
## 5 Experiment and Result Analysis
### Experimental Results and Analysis
#### 5.4.2 Comparison with Other Detection Methods
Then, with the increase in the number of positive samples, the detection effect gradually shows a downward trend. It can be found that after the expansion of the training data set, the precision rate, accuracy rate, and F1-Score of the shallow machine learning algorithm have been greatly improved. The classifier is obtained using the deep learning algorithm based on the improved TextCNN, LSTM, and ATTENTION mechanisms to automatically learn and extract the feature training of various SQL injection statements. All evaluation indicators of the classifier for SQLIA detection we proposed are above 99.57%. Deep learning models can automatically learn feature representations through multi-layer neural networks, extracting high-level abstract features from raw data and reducing reliance on manual feature engineering. They also exhibit advantages in handling large-scale data, enabling better utilization of abundant information in the data and facilitating the modeling and understanding of highly nonlinear and complex problems. The performance in SQL injection detection is significantly better than the method using shallow machine learning. Comparison with Common Deep Neural Networks  
It is compared with several commonly used deep neural networks (CNN, RNN, and TRANSFORMER) [32] in the field of deep learning. For a fair comparison, the above network also sets three hidden layers as per the method proposed in this paper. CNN uses a one-dimensional convolution kernel for detection, and TRANSFORMER uses a three-layer encoder structure. The GRU + ATTENTION network structure is input \(\rightarrow\) GRU1 \(\rightarrow\) GRU2 \(\rightarrow\) ATTENTION \(\rightarrow\) Dense. After parameter tuning, the best results are selected for comparative analysis. The experimental results of each method are shown in Figure 9, where (a), (b), (c), and (d) are the results under the four metrics. As shown in Figure 9, from the perspective of the comprehensive index F1 of SQL injection detection effect, the effect of TextCNN on the dataset DS1 is basically the same as that of TRANSFORMER and RNN, and both are relatively poor, followed by the GRU+ ATTENTION structure. The method in this paper has the highest F1 value. With the increase in the number of positive samples in the training samples, the ratio of positive and negative samples gradually tends to one, and the detection rate of the classifier obtained by training is also gradually increasing. The detection effect on the data set DS5 reaches its peak, and the false negative rate is less than 1%. At this time, the deep learning method proposed in this paper still has the best effect, followed by the GRU + ATTENTION structure, and TextCNN has the worst comprehensive effect. CNN needs to obtain the local correlation of data, while RNN mainly obtains the sequence characteristics of data. The test results show that the sequence characteristics of SQL injection data can better reflect the characteristics of SQL injection data than local correlation. Because the TRANSFORMER structure uses the ATTENTION mechanism completely, it is difficult to learn the sequence, so the effect is not very good. The effect of adding the ATTENTION mechanism to the GRU model is second only to the method proposed in this paper. It shows that the use of the ATTENTION mechanism can solve the problem of long-distance gradient disappearance in LSTM or GRU to a certain extent, thereby improving the detection effect. It can also be seen from Figure 9 that the deep learning method based on the improved TextCNN, LSTM, and ATTENTION mechanisms proposed in this paper is basically better than other structure detection methods in four indicators. This is mainly because the structure proposed in this paper takes into account both the local features in the sample and the sequence features in the sample. It also improves the problem of the model itself. Therefore, the method in this paper is more suitable for SQL injection attack detection than other deep neural networks.