# Deep Learning-Based Detection Technology for SQL Injection Research and Implementation
## 2 Related Studies  
Due to the variety of SQL injection attacks and their great harm, researchers have proposed many SQLIA detection methods. The conventional methods for detecting SQL injection can be categorized into three fundamental approaches: static detection, dynamic detection, and dynamic and static combination [6]. Static detectionStatic detection methodologies, such as white-box testing, involve the evaluation of potential SQL injection vulnerabilities via static source code analysis [7] without necessitating program execution. [PERSON] et al. developed a code analysis tool, the JDBC Checker [8]. While this tool can identify specific types of SQL injection attacks, it lacks preventive measures. [PERSON] et al. extended white-box testing [9] to detect tautology attacks. Notably, static detection must check the source code of the web application and requires specific professional knowledge. The relatively high false positive rate results in considerable consumption of time and resources, thereby limiting its practicality. Dynamic detectionDynamic detection, unlike static detection, identifies SQL injection vulnerabilities in web applications without requiring access to the application source code. This process involves dynamic penetration testing or real-time model generation. [PERSON] et al. proposed a dynamic taint analysis method [10] and devised an embedded analysis model within the web application. They utilized SQL lexical and syntax analysis techniques to parse SQL statements into SQL syntax trees using taint analysis. SQL injection attacks can be identified by examining the tainted state. [PERSON] et al. developed a signature-basedframework for SQL injection attack detection, improving the pattern-matching [11] method. This approach integrates fingerprint recognition and pattern matching to differentiate between legitimate SQL queries and malicious ones. Although this method has a low false positive rate, it struggles to identify concealed and newly emerging SQL injection attacks. [PERSON] et al. introduced CANDID, which uses the expected parse tree [12] in comparison with the runtime parse tree to detect SQLIA. Queries flagged as SQLIA result from a mismatch between the trees. However, the runtime parse tree comparison is resource-intensive and only capable of detecting certain types of attacks. Consequently, most dynamic detection methods suffer from drawbacks such as complex feature extraction, slow detection speed, and high system resource consumption. _Dynamic and static combination._ Combining static and dynamic detection leverages the advantages of both approaches by integrating static source code analysis with dynamic real-time monitoring. In the static analysis phase, a secure SQL statement model is established based on the source code of the web application. In the dynamic analysis phase, the SQL statements are intercepted before they are submitted to the database and compared against the model obtained from the static analysis phase. Discrepancies are flagged as SQL injection attacks, and the query execution is terminated and recorded. AMNESIA [13], as proposed by [PERSON], implements this strategy. It performs static analysis of the web application to discern the locations where SQL queries are sent to the database and generates a normal SQL query model. During the dynamic phase, it monitors dynamically created queries to ensure they conform to the static model. Queries that do not match the model are identified as SQLIA and blocked, and the relevant information is reported to developers and administrators. [PERSON] et al. proposed a method based on URL-SQL mapping [14], which analyzes user behavior and SQL execution responses to detect and defend against SQL injection. This method introduces minimal additional cost to the web application and can still detect and prevent SQL injection even under high volumes of attacks.