# Enhancing the Performance of SQL Injection Attack Detection through Probabilistic Neural Networks
## 3 Detection of SQL Injection Using Probabilistic Neural Network
### Probabilistic Neural Network  
A neural network consists of interconnected layers of artificial neurons. The neurons in the input layer are connected to the neurons in the hidden layer, which are then connected to the output neuron. The weight of each connection represents how much impact that particular connection has on a neuron's activity. One of the most popular neural networks is called a probabilistic neural network (PNN) [29]. PNNs are based on Bayesian inference and are used for classification and regression tasks, such as predicting prices or ranking search results. Every time the PNN model creates a piece of text, it becomes better at predicting which words are likely to come next. This process is similar to the way humans learn language and grammar from the environment. The PNN predicts the value of a variable by combining information from other variables in an inferred probabilistic way [30]. The kernel performs the basic operation in PNN. It is used to compute the probability of a particular outcome given an input. A kernel can be seen as a function that takes an input and maps it to another dimension (feature map). The kernel is then multiplied by all the dot products with each feature map. The advantage of using PNN is that it is significantly faster in training, produces more accurate results than multilayer perceptron networks, and is relatively insensitive to outliers. In view of the advantages of PNN, we extend it to the detection of SQL injection attacks.  
PNNs have four types of layers, an input layer, a pattern layer, a summation layer, and an output layer; inputs flow through a series of \"hidden\" layers before reaching an output level, as shown in Figure 2[31]. The function of the input layer is to obtain the input and distribute it to the neurons. Once the input is delivered from the input layer to the pattern layer in the form of a pattern \(x_{ij}\), which is the neuron vector, the output is computed by the pattern layer using Equation (2).  
\[\varnothing_{ij}(x)=\frac{1}{(2\pi)^{\frac{4}{2}}\sigma^{d}}\text{exp}[\frac{ (x-x_{ij})^{T}(x-x_{ij})}{2\sigma^{2}}] \tag{2}\]  
where \(d\) represents the dimension related to the pattern vector \(x\), and \(\sigma\) represents the parameter for smoothing. The summation layer performs the estimation of the maximum likelihood of pattern \(x\) being categorized in \(C_{i}\) classes. The outputs produced by neurons are combined and averaged according to which particular class they belong. The summation layer is based on Equation (3).  
\[p_{i}(x)=\frac{1}{(2\pi)^{\frac{4}{2}}\sigma^{d}}\frac{1}{N_{i}}\sum_{j=1}^{N_{ i}}\text{exp}[\frac{(x-x_{ij})^{T}(x-x_{ij})}{2\sigma^{2}}] \tag{3}\]  
\begin{table}
\begin{tabular}{l l} \hline \hline
**Feature Name** & **Feature Description** \\ \hline Token\_Count & Counts the presence of specific tokens in the whole dataset \\ \hline Token\_Type & Category to which the token belongs, such as plain text or SQL \\  & injection attack \\ \hline Token\_Value & The actual parameter value of the token \\ \hline \multirow{2}{*}{Type\_Protocol} & Transmission Control Protocol (TCP) \\  & Internet Protocol (IP) \\  & Internet Control Message Protocol (ICMP) \\ \hline Length\_TCP & Data Offset; The size of the TCP header in 32-bit words \\ \hline http\_content\_length & Length of Entity Body \\ \hline Type\_Port\_Req & Port Type \\ \hline Source\_Data\_length & Number of Characters in a String \\ \hline \hline \end{tabular}
\end{table}
Table 1: List of Selected Features.  
\[\hat{C}(x)=\operatorname*{argmax}\{p_{i}(x)\,\},i=1,2\ldots,m \tag{4}\]  
Based on the Bayes criterion, the final output is computed using Equation (4). Where \(C(x)\) represents the class estimation with respect to the pattern \(x\). \(m\) denotes the total samples in a class.