# SSQLi: A Black-Box Adversarial Attack Method for SQL Injection Based on Reinforcement Learning
## 2 Related Work  
Recently, much research has focused on adversarial learning against various fields. [PERSON] et al. proposed SimBA based on a black-box framework to deceive image recognition applications in real-world scenarios [17]. [PERSON] et al. designed a framework of tools for natural language adversarial attacks [18]. [PERSON] et al. evaluated adversarial attacks against DNNs on facial recognition files [19]. [PERSON] et al. proposed a poisoning attack in recommender systems that generates plausible fake profiles using generative adversarial networks (GAN). They used the adversarial approach of generative adversarial networks (GAN) to generate reasonable fake profiles that resemble normal profiles, and achieved better results than previous state-of-the-art attacks attacking performance [20].  
In the web security field, plenty of research has been focused on detection using machine-learning and deep-learning frameworks. [PERSON] et al. utilized ensemble-learning based on Bayesian networks to detect XSS [21]. [PERSON] et al. proposed a graph feature framework to detect SQL injection in SVMs [4]. [PERSON] et al. utilized ensemble learning and a set of regex rules as features to identify SQL injection [3]. [PERSON] et al. showed that an LSTM model could perform well in SQL injection detection [5].  
With so many classifier models proposed in the literature, their reliability has become a growing concern.Recent research has focused on XSS attacks. [PERSON] et al. utilized a GAN-based approach for MCTS-T to explore adversarial attacks against XSS detectors [7]. [PERSON] et al. then proposed a framework based on the DDQN networks for further exploration [8]. [PERSON] et al. proposed more feasible strategies and utilized soft Q-learning to generate fuzz examples that significantly improved the escape rates of previous works [9].  
Unfortunately, little research has focused on adversarial attacks on SQL injection. [PERSON] et al. utilized a transformer model to translate an SQL injection payload into quality syntax to analyze the vulnerabilities in websites [11]. Since their framework was based on interactive application security testing, their system did not generate adversarial examples against SQL detectors. The A-MoLE approach attempted to explore adversarial attacks against SQL with mutational fuzzing [12]. However, since the mutation search strategies were based on a simple mutation tree, they could not achieve optimized multi-fold strategies to escape detection. In addition, their mutation strategies were designed for common mutations against weak WArs. For example, modern detectors are insensitive to URL-encoding and changes in string cases. [PERSON] and [PERSON] proposed an evasive WAF based on reinforcement learning, and they formulated the WAF evasion problem into a reinforcement-learning problem to test their framework on XSS and SQL-injection payloads [14]. However, they did not include grammar-aware state representation or mutations for SQL injection. [PERSON] et al. presented an automated black-box testing strategy to discover injection vulnerabilities in WArs [15]. They clustered string-based code-injection payloads, such as XSS and SQL injection, and utilized a reinforcement-learning technique combined with a novel adaptive search algorithm to search the clusters and discover bypassing attack patterns. Their proposal could discover vulnerabilities in WArs efficiently; however, they could only select existing attack payloads and could not create new SQL injection payloads. [PERSON] and [PERSON] proposed a framework to bypass WArs using deep reinforcement learning and designed specific action spaces for SQL injection attacks [13; 16]. However, they only tested their framework on ModSecurity-CRS, Naxsi, and WAF-Brain, without testing the deep-learning-based detection model proposed by the academy.  
Based on the aforementioned research and current challenges in the field, it is urgent to establish a feasible adversarial attack framework to evaluate the potential risk of SQL injection vulnerabilities.