# Deep Learning-Based Detection Technology for SQL Injection Research and Implementation
## 2 Related Studies
However, there are uncertainties in system SQL execution, and the extraction of invariants (normal states of the web application) is not comprehensive, leading to a significant number of false positives and false negatives. The above methods can be well expanded in the traditional string matching at that time. Now attackers use more complex tools to launch automatic injection attacks. These methods cannot detect various SQL injection attacks well. The problem of SQLIA detection is a typical classification problem, so many researchers started to focus on the utilization of machine learning technology to solve the problem of SQL injection attack detection. For instance, [PERSON] et al. employed n-gram features extracted from SQLIA code [15] to train an SVM classifier and achieve better detection performance. Nonetheless, the accuracy of this method is contingent upon various patterns, which restricts its utility. [PERSON] et al. designed a SQL injection scanning tool based on crawler and machine learning methods [16], which can automatically detect potential SQL injection security vulnerabilities in websites. However, due to the limitations of scannable datasets, it only recognizes a small assortment of attack types. [PERSON] et al. extracted features using blank-separated and token methods [17]. They proposed a method for adaptive classification of malicious web code using machine learning methods, including NB, SVM, and KNN. While the experiments showed promising results, the dearth of test samples and training samples could lead to overfitting, and not all types of SQLIA can be effectively detected. Moreover, manual feature construction proves inefficient due to its high cost, excessive reliance on expert knowledge, difficulty in ensuring feature efficacy, substantial feature redundancy, escalated training costs, and a lack of ability to capture complex patterns and scalability. Traditional machine learning methods usually require manual feature engineering, while deep learning models [18; 19; 20] can automatically learn hierarchical feature representations of data. Additionally, deep learning is scalable and usually works well for large-scale datasets, with its performance continually improving as the dataset expands. [PERSON] et al. proposed a new detection method based on long short-term memory and an abstract syntax tree [21], which can detect SQLIA from the raw query strings, even in SQL detection bypass scenarios. Inspired by the layered architecture design of LSTM [22], [PERSON] et al. developed a layered architecture model for various web attack detection, achieving an SQLIA detection accuracy rate of 89.34%. [PERSON] et al. proposed a hybrid detection method based on CNN-Bi-LSTM [23], using a convolutional neural network for feature extraction and Bi-LSTM for learning long-term dependencies of data. This method achieved an experimental accuracy rate of 98%. [PERSON] et al. put forth an SQLIA detection method based on adaptive deep forests [24], which effectively solved the problem that the original features of deep forests degenerate with the increase in layers, and the experimental results obtained an accuracy rate of 98.75%. [PERSON] et al. utilized a probabilistic neural network [25] to detect SQL injection attacks and employed the BAT algorithm to optimize parameter selection. This method can produce more accurate results than the multi-layer perceptron network and is relatively insensitive to outliers; the experimental results obtained an accuracy rate of 99.19%. However, methods based on deep learning algorithms still face numerous challenges. Firstly, since there are few publicly available SQL injection sample datasets, the lack of enough samples will lead to an overfitting problem during the training process. Secondly, the method of converting SQL samples into feature vectors also needs to be further studied.