# SSQLi: A Black-Box Adversarial Attack Method for SQL Injection Based on Reinforcement Learning
## 4 Experiment  
### Experimental Setup  
Dataset: In this study, we collected 34,395 SQL-injection-attack examples from open-source attack intelligence websites, GitHub, and a specific dataset for SQL injection detection research [29]. Next, we crawled a large number of SQL query statements based on Amazon Alexa's top-1000 websites, of which 45,991 were randomly selected as a normal example in the dataset. We used 34,395 items from each of the attack and normal examples for training; the remaining 11,596 samples were used as the testing set. Devices and environment: We built our models in an ArchLinux 5.15.13 environment. In addition, the deep-learning-based detector was coded in Tensorflow-GPU 2.7.0 and the machine-learning-based detector was coded in the SKlearn library, whereas JIT techniques from the Numba library were used during the feature-vector-generation phase.The configuration of the server for the experiment was the following: an i912900 KF CPU and an NVIDIA GeForce RTX 3090 Ti 24G GPU. Comparison experiment: In order to prove the advancement and the effectiveness of the method proposed in this paper, two models were selected for comparison: WAF-A-Mole [12] and the DDQN [30] algorithm-based adversarial attack model. Our adversarial attack method was tested on four types of detectors: WAFs, deep-learning-based detectors, machine-learning-based detectors, and ensemble-learning-based detectors. Attack method parameters: We tested the performance of three attack methods in our experiments: SSQLi based on the SAC algorithm, as proposed in this paper; SSQLi based on the DDQN algorithm; and WAF-A-Mole as proposed in [12]. The following describes the parameter settings for these attack methods:  
1. SAC: Our strategy selector \(\pi\) contained \(64\times 64\) hidden layer and used a softmax function as the activation function of the output layer. The critic model contained a 64 \(\times\) 64 hidden layer and used a softmax function as the activation function of the output layer. Furthermore, the size of experience buffer was 100,000. The optimal maximum step-size and the number of training iterations would be selected in the parameter setting experiment. 2. DDQN: This model contained a \(30\times 15\) hidden layer, a maximum iteration step-size set at 100, epochs set at 10, and a batch-size set at 256. 3. WAF-A-Mole: WAF-A-Mole was the most recent adversarial attack model for SQL injection in the existing research to date. The model built a mutation strategy tree and would return to a previous node to choose another strategy when the current mutation method could not successfully bypass the detection model. To be consistent with the model setup in this paper, the maximum iterations of WAF-A-Mole was set at 100. **Detector parameters**: In our experiments, we selected two mainstream WAFs and built eight detection models based on deep learning and machine learning. The two WAFs were as follows:  
1. SafeDog [31]: SafeDog is a mature WAF system based on rule-matching. The version used in this experiment was updated on 10 February 2022, and the detection rules and levels of this system were set to the default mode. 2. ModSecurity [32]: ModSecurity is an open-source WAF system developed by the ModSecurity team. The system uses both a rule-matching method and a syntax-analysis method to prevent SQL injection. In this experiment, all parameters of the system were set to default. The overall framework of the detection model is shown in Figure 6, and the relevant settings for the deep-learning- and machine-learning-based detection models are shown in Table 4. Furthermore, to build the deep-learning-based detector, we referenced [5; 29; 33]; to build the machine-learning-based detector, we referenced [4; 34]; and to build the ensemble-learning-based detector, we referenced [3]. For feature extraction, we used the method proposed in [29; 33]. In [29], the authors used the Word2 Vec algorithm to map the payload text to word vectors and then stitch them together into sentence vectors.