# Deep Learning-Based Detection Technology for SQL Injection Research and Implementation
## 4 Deep Learning Model Based on Improved TextCNN and Bi-LSTM
### Improved TextCNN Algorithm  
TextCNN is an algorithm that applies convolutional neural networks to sentence classification, as proposed by [PERSON] in 2014 [26]. The convolutional neural network has always been a sharp tool in the direction of computer vision. [PERSON] improved on CNN and proposed a text classification model called TextCNN. Because of its simple network structure, less calculation, fast training speed, and excellent effect, it was widely used by researchers. Since SQL is essentially a formal language that can be understood as a meaningful language sequence, the SQL injection attack samples studied in this paper are also text. Consequently, this paper makes appropriate improvements to the TextCNN algorithm to make it more applicable to the SQL injection attack detection task. The basic TextCNN mainly includes basic neural network components such as the embedding layer, convolutional layer, and pooling layer, as follows:  
* Embedding layer: In the text field, it is mostly used to convert words appearing in the text into fixed-size vectors. It is a flexible layer that can be used in various ways. It can be used only to learn word vectors used in another model it can also be used as part of a deep learning model to learn both word vectors and the model itself or it can be used to load pre-trained word vectors. * Convolutional layer: It is composed of convolutional units, the parameters of which are obtained through backward propagation learning. The convolutional layer in the SQL sample is mainly for feature extraction and feature mapping of the vectorized SQL text and iterates from low-level features. Extract more complex, high-level features. * Pooling layer: It mainly performs down-sampling operations on the feature map extracted by the convolutional layer and divides the space into multiple regions according to the size of the convolution kernel. And use a different pooling method to calculate a pooled value from these areas to replace the commonly used average pooling and maximum pooling. To enhance its applicability in the realm of SQLIA detection, we improved the pooling layer of TextCNN. The subsequent section outlines the comprehensive processing procedure of the enhanced TextCNN model discussed in this paper, specifically tailored for the detection and handling of SQL injection. This allows for effective handling of sample processing tasks. The architecture of TextCNN for processing SQL injection text is shown in Figure 3. The embedding layer first embeds the SQL injection text into a low-dimensional vector space, and the convolution layer uses multiple convolution kernels of different sizes to perform convolution operations on the embedded word vectors. Next, the pooling layer converts the result of the convolution operation into a long feature vector and adds a regular term. The specific steps and principles are as follows: The mathematical symbols appearing in the following text are represented as shown in Table 1.  
\(x_{i}\in R^{k}\) is the k-dimensional word vector corresponding to the \(i\)-th word in the sample. Due to the use of dual channels, each word corresponds to two k-dimensional word vectors. Therefore, a SQL statement with a length of \(n\) (if it is shorter than \(n\), it needs to be filled with zero vectors, and if the length is greater than \(n\), it needs to be truncated) is expressed as Formula (1):  
\[x_{1:n}=x_{1}\oplus x_{2}\ \oplus\cdots\oplus x_{n} \tag{1}\]  
Among them, the symbol \(\oplus\) is the splicing operation, \(x_{i+j}\) represents the splicing operation on \(x_{i},\ x_{i+1},\ldots,\ x_{i+j}\), and the convolution kernel, \(W\in R^{h*k}\), is applied to all words with a window size of \(h\) to generate feature \(c_{i}\).