## Appendix B
### Cluster-Based Organization of Input  
The prompt groups SQLi patterns into six clusters, each with unique characteristics and examples. This organization helps the LLM focus on distinct types of obfuscation and simplifies the process of creating tailored rules.  
Cluster 0: Character Manipulation & String Obfuscation Characteristics:  
Heavy use of functions like CHAR, ORD, ASCII, and CONCAT. Obfuscated comparisons (e.g., 'a' = 'a' or NULLIF). Logical tautologies (1 = 1) with string manipulation. Inline obfuscated comments (e.g., /\"hidden*/).  
Example Queries:  
or (SELECT CASE WHEN (1 = 1 AND CONCAT('a', \") = 'a') THEN 1 ELSE 0 END) = 1- or (SELECT CASE WHEN (1 = 1 AND CHAR(97) = CHAR(97)) THEN 1 ELSE 0 END) = 1- Generate SecRules to detect:  
Character manipulation functions. Obfuscated comments. Tautologies using string equivalence or logical comparisons.  
Cluster 1: Tautologies with Encoding and Collations Characteristics:  
Tautologies like 6872 = 6872 combined with obfuscated encoding (ASCII, ORD, CHAR). Use of collations (e.g., COLLATE utf8 mb4_bin). Hexadecimal logic (0 \(\times\) 61 = CHAR(97)).  
Example Queries:  
-7552 OR (SELECT CASE WHEN (6872 = 6872 AND ASCII('a') = 97) THEN 1 ELSE 0 END) = 1 -7552 OR (SELECT CASE WHEN (6872 = 6872 AND CHAR(97) = 'a' COLLATE utf8 mb4_bin) THEN 1 ELSE 0 END) = 1 Generate SecRules to detect:  
Encoding functions (ASCII, ORD, CHAR). Tautologies involving numeric or hexadecimal encoding. Collation usage in queries.  
Cluster 2: Numeric Obfuscation & Logical Comparisons  
Characteristics:  
Numeric tautologies (3038 = 3038) and comparisons (HEX(3038) = HEX(3038)). Logical expressions with NULLIF and CONCAT. Obfuscation using inline comments (e.g., /*comment*/).  
Example Queries:  
-911 OR (SELECT CASE WHEN (3038 = 3038) THEN 1 ELSE 0 END /*no = 0*/) = 1 -911 OR (SELECT CASE WHEN (HEX(3038) = HEX(3038)) THEN 1 ELSE 0 END) = 1 -  
Generate SecRules to detect:  
Numeric tautologies and logical obfuscations. Inline comments masking intent.  
Cluster 3: ASCII/ORD Obfuscation Characteristics:  
Character comparisons using ASCII and ORD functions. Logical expressions with nested obfuscation. Heavy reliance on CHAR, ASCII, and numeric tautologies.  
Example Queries:  
or (SELECT CASE WHEN (1 = 1 AND ASCII('a') = 97) THEN 1 ELSE 0 END) = 1-911 OR (SELECT CASE WHEN (ORD(CHAR(97)) = 97 AND 3038 = 3038) THEN 1 ELSE 0 END) = 1  
Generate SecRules to detect:  
ASCII and ORD logic. Character manipulation combined with numeric tautologies.  
Cluster 4: Encoding Obfuscation with HEX/UNHEX  
Characteristics:  
Obfuscation with HEX and UNHEX. Nested encoding (e.g., UNHEX(HEX(...))). Comparisons of encoded strings.  
Example Queries:  
or (SELECT CASE WHEN (1 = 1 AND UNHEX(HEX('a')) = UNHEX(HEX('a'))) THEN 1 ELSE 0 END) = 1-7552 OR (SELECT CASE WHEN (6872 = 6872 AND HEX('a') = HEX(CONCAT('a'))) THEN 1 ELSE 0 END) = 1  
Generate SecRules to detect:  
HEX and UNHEX obfuscations. Encoded string comparisons.  
Cluster 5: Inline Comments & Simplified Tautologies  
Characteristics:  
Heavy use of inline comments (/*comment*/). Simplified tautologies combined with logical operators or string comparisons ('a' = 'a', LIKE).  
Example Queries:  
or (SELECT CASE WHEN (1 = 1 AND 'a' = 'a' /*comment*/) THEN 1 ELSE 0 END) = 1- or (SELECT CASE WHEN (1 = 1 AND 'a' LIKE 'a%') THEN 1 ELSE 0 END /*comment*/) = 1-  
Generate SecRules to detect:  
Inline comments. Logical operators and simple tautologies