Detection of SQL Injection Attacks on MariaDB Using Hybrid Long Short-Term Memory

Abstract

This study discusses the development of a SQL Injection attack detection system using the Long Short-Term Memory (LSTM) deep learning model. SQL Injection is a serious security threat to web applications that exploits vulnerabilities in user input to manipulate databases. The LSTM model was chosen due to its ability to process sequential data, which is relevant for analyzing the patterns and structure of SQL queries that are susceptible to attacks. The process begins by collecting and combining datasets from various sources, performing preprocessing to handle duplicate data, missing values, and gibberish queries, as well as analyzing the distribution of query lengths. The textual query data is then converted into a numerical representation through tokenization and padding. The processed dataset is divided into training and testing data. The Bi-directional LSTM model architecture is built with embedding, LSTM, dropout, and dense layers. The model is trained using the training data and its performance is evaluated using the test data, producing metrics such as accuracy, precision, recall, and F1-score. Evaluation results on the test data show a model accuracy of 99.99%, with precision of 99.99%, recall of 99.99%, and F1-score of 99.99% in distinguishing between normal queries and SQL Injection queries. The trained model and the tokenizer used are then saved for further testing purposes. This research demonstrates that the LSTM-based approach is highly effective in detecting SQL Injection attacks with high accuracy. Thus, the model can be deployed at the production level or production server.