用生成模型合成数据提升SQL注入检测准确率
Enhancing SQL Injection Detection and Prevention Using Generative Models
- 用VAE、CWGAN-GP和U-Net生成合成SQL语句扩充训练集
- 检测准确率提升，误报和漏报同时减少
- 适合安全研究者与防御系统开发者参考
SQL注入（SQLi）持续威胁网页应用安全，使攻击者能在未授权情况下操纵数据库并获取敏感信息。尽管检测技术已有进展，传统基于签名的方法仍难以识别规避预设模式的复杂攻击。随着攻击手段不断演变，亟需更自适应的检测系统。本文提出一种创新方法，利用生成模型增强SQLi检测与防护机制。通过变分自编码器（VAE）、带梯度惩罚的条件水印生成对抗网络（CWGAN-GP）与U-Net，生成合成SQL查询以扩充机器学习模型的训练数据集。实验证明，该方法显著提升了检测系统的准确性，有效降低误报与漏报率。大量测试表明，系统具备应对新型攻击模式的适应能力，整体精度与鲁棒性均得到增强。
原文摘要 · Abstract (English)
SQL Injection (SQLi) continues to pose a significant threat to the security of web applications, enabling attackers to manipulate databases and access sensitive information without authorisation. Although advancements have been made in detection techniques, traditional signature-based methods still struggle to identify sophisticated SQL injection attacks that evade predefined patterns. As SQLi attacks evolve, the need for more adaptive detection systems becomes crucial. This paper introduces an innovative approach that leverages generative models to enhance SQLi detection and prevention mechanisms. By incorporating Variational Autoencoders (VAE), Conditional Wasserstein GAN with Gradient Penalty (CWGAN-GP), and U-Net, synthetic SQL queries were generated to augment training datasets for machine learning models. The proposed method demonstrated improved accuracy in SQLi detection systems by reducing both false positives and false negatives. Extensive empirical testing further illustrated the ability of the system to adapt to evolving SQLi attack patterns, resulting in enhanced precision and robustness.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。