# SSQLi: A Black-Box Adversarial Attack Method for SQL Injection Based on Reinforcement Learning
## 3 Proposed Method
### Strategy Matrix
#### 3.2.1 Syntactic Transformation Strategy  
Based on the common bypass techniques summarized by the open-source security intelligence team [23] and the preset functions provided by the official MySQL manual [24], this study developed the following 11 syntax transformation strategies:  
1. Delay function replacement: The benchmark function in MySQL was used to test the performance of SQL statements and cause a delay when executing complex functions multiple times, so that the benchmark function could replace the sleep function, which is commonly used in SQL injection attacks.
2. Error function replacement: When strings and numbers were executed as parameters of the bin_to_uuid function, the error message of MySQL database printed the value of incoming parameters, so the bin_to_uuid function could replace common error-reporting functions, such as the \"updateXML\" in the SQL-injection-attack samples.
3. Comment confusion: To reduce the rate of false alarms, some WAFs ignore the content of the annotations; therefore, this method could hide the attack characteristics in these WAFs.  
Figure 3: Dynamic variation process of the payload during mutation.  
String-to-hex: Some detectors trigger alerts for SQL query statements accessing sensitive directories, in which case, converting strings to hexadecimals could evade the detection of sensitive directories.
5. Equation conversion: To reduce the rate of false alarms, most WAFs only trigger alerts if the product has only keywords and equations presented together, so this approach could hide the attack signature.
6. Table-name confusion: WAFs often use sensitive words, such as table names, to detect SQL injection attacks; therefore, this method could hide this attack feature.
7. Replace spaces with comments: Some detectors are sensitive to space characters, so replacing them could reduce the likelihood of being detected.
8. Redundant keyword omission: There are some keywords, including \"as\" in MySQL, that can be ignored when used but are easily detected as attacks, so we needed to eliminate these redundant keywords to avoid attacks.
9. Keyword replacement: We could use special characters as substitutes for sensitive keywords: For example, we could replace \"and\" with \"&&\".
10. Special table-name substitution: In addition to table name interference, some built-in MySQL tables have functional equivalences, such as some tables in the system library that could replace information in the information_schema library and could hide the attack characteristics of common tables.
11. ODBC-syntax interference: ODBC syntax is used to solve data-sharing problems between heterogeneous databases. This syntax places curly brackets around the execution of the shared content and then adds a string identifier that MySQL ignores when parsing and executing the shared content directly.  
We show examples of the above 11 transformation strategies in Table 2, where the text marked in red denotes the replaced content.  
These interference strategies could attack some feature-based matching methods and affect syntax-analysis-based detectors, to some extent.