A Detection Method for SQL Injection Attacks by Integrating Semantic and Structural Features
Ding Fuhao
Guo Xiaojun
Han Yixin
Abstract：SQL injection attacks have become a serious security threat in web applications.Existing detection meth-ods primarily rely on natural language processing and focus on semantic features.However,the rich structural infor-mation embedded in SQL statements is often overlooked,making it difficult for traditional approaches to effectively capture these structural features.To address this,this paper proposes a detection method for SQL injection attacks that integrates both semantic and structural features,aiming to improve detection accuracy and robustness.Specifi-cally,this paper utilizes a self-attention mechanism combined with a bidirectional long short-term memory network(SA-BiLSTM)for semantic feature extraction to thoroughly explore the logic and intent of SQL queries.Mean-while,convolutional operation is applied to the subtrees of SQL abstract syntax tree to extract structural features.Ex-perimental results on multiple public datasets demonstrate the effectiveness of the proposed method,which outper-forms in various evaluation indicators including accuracy,F1 score and recall.The results show that the proposed method achieves detection accuracy and AUC greater than 99%,with an F1 score reaching 95%.
Keywords：SQL injection attackFeature fusionSelf-attention mechanismBidirectional long short-term memory networkAbstract syntax tree
Publication Date：2025-07-30
Online Publishing Date：2025-08-18(First online date of this platform, not the publication date of the document)
Pages：11( 70-80 )