A SQL injection attack detection method based on a few abnormal labels

Abstract:

SQL injection attacks would cause significant harm because they can steal or destroy data by intruding target database. SQL injection attack detection can find out the potential security threat in time, and it is beneficial to the database security protection. However, in intelligent transportation system, due to its internal complexity and the emergence of new varieties of SQL injection attacks, the size of abnormal samples cannot meet the requirement of machine learning model training. This would carry a significant risk of model overfitting and performance degradation. In order to solve the problem, a SQL injection attack detection framework is designed based on bit coding, considering the characteristics of intelligent transportation systems and SQL injection attacks comprehensively. In the framework, pre-training word embedding model and parsing of grammatical rules are not needed. Then, a semi-supervised SQL injection attack detection model (ASDM) is proposed based on this framework, combined with the attention mechanism. In the model, the samples are reconstructed to learn the high-level features(such as the central trend and the dispersion degree of the features) and to express the feature posterior distribution and feature deviation. Then, these high-level features are fused with the data coding features to highlight the differences between different types of data. Finally, the attention mechanism and residual network are introduced to construct the detector, with the aim of exerting different attention intensity to the features according to their importance degree and guaranteeing the generalization ability of the model. The experimental results show that the proposed method has better detection performance compared with other SQL injection attack detection methods for the data with unbalanced labels, and can detect unknown SQL injection attacks.