# Enhancing the Performance of SQL Injection Attack Detection through Probabilistic Neural Networks
###### Abstract  
SQL injection attack is considered one of the most dangerous vulnerabilities exploited to leak sensitive information, gain unauthorized access, and cause financial loss to individuals and organizations. Conventional defense approaches use static and heuristic methods to detect previously known SQL injection attacks. Existing research uses machine learning techniques that have the capability of detecting previously unknown and novel attack types. Taking advantage of deep learning to improve detection accuracy, we propose using a probabilistic neural network (PNN) to detect SQL injection attacks. To achieve the best value in selecting a smoothing parameter, we employed the BAT algorithm, a metaheuristic algorithm for optimization. In this study, a dataset consisting of 6000 SQL injections and 3500 normal queries was used. Features were extracted based on tokenizing and a regular expression and were selected using Chi-Square testing. The features used in this study were collected from the network traffic and SQL queries. The experiment results show that our proposed PNN achieved an accuracy of 99.19% with a precision of 0.995%, a recall of 0.981%, and an F-Measure of 0.928% when employing a 10-fold cross-validation compared to other classifiers in different scenarios. c 2023134365 [1][  
SQL injection attacks are one of the most dangerous flaws that attackers use to obtain private data without permission, steal money, and hurt reputations [6]. Information disclosure, data manipulation, account takeover, code execution, and denial of service are some of the most hazardous vulnerabilities exploited as a result of SQL injection attacks. Attackers may access and reveal sensitive data, including usernames, passwords, credit card numbers, and personal information via SQL injection attacks. This data can then be exploited for identity theft, fraud, and other nefarious purposes. Moreover, they have the ability to alter, remove, or even seize control of all of the database's data, which might result in the loss of crucial information as well as financial and reputational harm. Moreover, attackers have the ability to run malicious code on the targeted machine, obtain remote access to it, and take control of it. This allows for the theft of confidential data, data destruction, and other nefarious actions. Moreover, SQL injection attacks may be used to conduct denial-of-service attacks by bombarding the targeted system with many SQL queries, resulting in the system crashing or going down and inflicting harm to the system's reputation and finances [7; 8]. By adopting security best practices, performing routine vulnerability assessments, and using sophisticated detection and prevention methods, such as machine learning-based approaches, companies may take proactive steps to stop and identify SQL injection attacks. Web applications need to learn and sanitize the user input from external sources for any possible malicious SQL injection. Obtaining unauthorized access may be due to software developers' poor programming practices and the cybercriminals who intentionally design the attack behind the scenes [9]. Cybercriminals regularly work on practices to get hold of sensitive data to achieve their objectives. Four types of SQL injection attacks are Error based SQL injection, UNION based SQL injection, Blind SQL injection, and Out of band SQL injection [10]. The Out of band SQL type is termed one of the common attacks, occurring when an invalid common is entered as an input, which triggers the response from the database server. The database server may respond with an error message containing the details about the data structure, version of DBMS, type and version of operating stem running and, in some cases, display the complete query results. UNION-based SQL injection attacks use the UNION operator of SQL, allowing multiple statements to be combined into at least one among the combined query performing the malicious activities by extending the output generated by the original query.