# Deep Learning-Based Detection Technology for SQL Injection Research and Implementation
## 1 Introduction  
SQL injection attacks pose a significant threat to web applications, constituting one of their gravest security vulnerabilities. These attacks present unique features such as a multitude of variants, rapid evolution, covert attack vectors, and potentially severe consequences. Traditional SQL injection detection methodologies--including static and dynamic analysis as well as instruction randomization--predominantly rely on rule-based detection. However, these approaches often suffer from low accuracy, high false positive rates, and an inability to adequately handle the escalating complexity of contemporary SQL injection attacks. Hence, the exploration and development of an effective detection strategy for SQL injection attacks remain a considerable challenge and of paramount importance. At present, feature extraction serves as the cornerstone for the majority of SQL injection detection methods. Most of these employ shallow machine learning techniques to identify SQL injection attacks, typically by extracting distinct elements from the SQL injection statements. To this end, researchers frequently extract explicit elements from these attack statements and employ simple machine learning methods for detection. For instance, [PERSON] et al. leveraged a combinatorial support vector machine [1] as aclassifier for SQL injection attack detection, integrating HMM and similarity distance algorithms. [PERSON] et al. employed a convolutional neural network [2] for the same purpose. [PERSON] et al. utilized an ensemble of four machine learning algorithms, namely the Gradient Boosting Machine (GBM), Adaptive Boosting Machine (AdaBoost), Extended Gradient Boosting Machine (XGBM), and Light Gradient Boosting Machine (LGBM) [3], which resulted in relatively high accuracy. Furthermore, [PERSON] et al. concluded that the Decision Tree Algorithm [4] emerged as the best classifier for SQLIA detection and prevention due to its highest sensitivity and specificity. While these methods can effectively detect a portion of SQL injection attacks with precise feature extraction, they demand a substantial allocation of human resources. Additionally, the accuracy of feature extraction significantly impacts detection results. As deep learning advances, researchers have attempted to utilize it for detecting SQLIA, but this approach often leads to overfitting problems. To address this issue, some researchers have proposed data set expansion to mitigate it. For example, [PERSON] et al. proposed a case clone extreme learning machine to expand the dataset [5]. Yet, this strategy remains reliant on the precision of selected features. Therefore, it is of the utmost importance to explore a scheme based on deep learning that can effectively detect SQLIA. In this paper, we propose a deep learning-based method for SQL injection attack detection that integrates TextCNN, LSTM, and the ATTENTION mechanism to construct a deep network. Initially, this method proposes a feature vectorization method for SQL injection samples based on TF-IDF and Word2 Vec. Coupled with the word embedding method, each word or phrase is mapped to a vector in the low-dimensional real number field. The similarity performance of the vector symbolizes the semantic similarity between words. Subsequently, upon vectorizing the samples in the corpus, we employ an enhanced TextCNN to extract the local features from the samples and use the Bi-LSTM network to extract the sequence information. Finally, to address the limited efficacy of LSTM on long sequence data, the ATTENTION mechanism is applied to reduce the distance between any two words in the sequence to one. This improves the effectiveness of the model. The rest of the paper is organized as follows: Section 2 describes the background of SQL injection detection and the related work. Section 3 introduces the framework of our SQL injection detection. Section 4 details the deep learning model based on improved TextCNN and Bi-LSTM. Section 5 presents the experiment and evaluates the results, and Section 6 concludes our work.