# Deep Learning-Based Detection Technology for SQL Injection Research and Implementation
## 5 Experiment and Result Analysis
### Experimental Results and Analysis
#### 5.4.2 Comparison with Other Detection Methods  
(1) Comparison with Classical Machine Learning Methods  
The machine learning methods used for comparison include SVM [30], KNN, decision tree, NB, and RF. In the feature selection part, this paper draws from the literature [31], which employs the correlated feature selection (CFS) algorithm for feature selection and uses a genetic algorithm for further optimizing the selection of feature subsets. The CFS algorithm considers both the correlation between features and the target variable as well as redundancy among the features themselves. It can select feature subsets that are more related and less redundant, thereby enhancing the model's performance and interpretability. The genetic algorithm can search a broader feature combination space, which assists in  
Figure 7: Changes in the accuracy rate of the maximum pooling parameter model with different K-values. \begin{table}
\begin{tabular}{c c c c c} \hline Batch\_size & 32 & 64 & 128 & 256 \\ \hline Training time (s) & 78 & 161 & 340 & 672 \\ \hline \end{tabular}
\end{table} 
Table 3: Training time of models under different batch_sizes. finding a more optimal feature subset. We tested the above algorithm on the data set DSi (i = 1, 2, 3, 4, 5, 6). The three kernel functions of SVM are introduced below:  
* Linear kernel (kernel = 'linear') \[\kappa(\mathrm{x},\mathrm{y})=\mathrm{x}^{\mathrm{T}}\mathrm{y}+\mathrm{c}\] (28)
* Gaussian kernel (kernel = 'rbf') \[\kappa(\mathrm{x},\mathrm{y})=\mathrm{exp}\left(-\frac{||\mathrm{x}-\mathrm{y }||^{2}}{2\sigma^{2}}\right)\] (29)
* Sigmoid kernel (kernel ='sigmoid') \[\kappa(\mathrm{x},\mathrm{y})=\mathrm{tan}\mathrm{h}\left(\mathrm{ax}^{ \mathrm{T}}\mathrm{y}+\mathrm{c}\right)\] (30)  
Choosing the best one for comparison, the experimental test results are shown in Figure 8, where (a), (b), (c), and (d) are the results under the four metrics. After adjusting the parameters during the experiment, it was found that the SVM detection effect using the linear kernel function is better than that using other kernel  
Figure 8: Comparison with classical machine learning approaches. (**a**) Accuracy. (**b**) Precision. (**c**) Recall. (**d**) F1-Score. functions. From Figure 8, it can be seen that the random forest detection effect in the shallow machine learning method shows the best performance. On the data set DS1, the detection accuracy F1-Score reaches 95.64%. The possible reason could be attributed to the better generalization ability of random forests, as they can automatically handle feature selection, capture nonlinear relationships, and exhibit robustness against noise and outliers. However, one drawback is that the model training time is relatively longer. Following this, the decision tree exhibits noteworthy performance, as it can handle mixed data types, process large-scale datasets, and remain insensitive to feature selection. This may be why the decision tree algorithm performs well. Then, we have Naive Bayes and SVM with a linear kernel, both of which showed similar detection performance. The KNN algorithm has the worst detection effect, at only 91.22%. The possible reasons for the poor performance of the KNN algorithm can be analyzed as follows: Firstly, the KNN algorithm is sensitive to feature dimensionality, particularly in high-dimensional data where the distances between data points become sparse, leading to inaccurate distance calculations. Moreover, the performance of the KNN algorithm highly depends on the selection of an appropriate K-value, and it is also sensitive to the weights of different features in the feature space. These factors can contribute to the suboptimal performance of the algorithm. With the increase in training samples, the F1-Score of detecting SQL injection using various shallow machine learning algorithms is also gradually increasing. The ratio of positive and negative samples is between 4:5 and 5:5. The largest increase is when the ratio is 1:1 and the experimental detection effect reaches its highest value.