用AI模型实时识别恶意GraphQL查询，防注入和攻击
Enhancing GraphQL Security by Detecting Malicious Queries Using Large Language Models, Sentence Transformers, and Convolutional Neural Networks
- 融合大模型与神经网络，分析查询语义和结构
- 检测成功率超95%，可防SQL注入、命令执行等攻击
- 适合需高安全性的云服务和API网关开发者
GraphQL的灵活性虽利于高效数据获取，却带来独特安全漏洞，传统防护手段难以应对。恶意查询可利用其动态特性实施拒绝服务、数据泄露及注入攻击。现有方案如静态分析、限流和通用WAF防护能力有限。本文提出一种基于AI的实时恶意查询检测方法，结合大语言模型（LLMs）进行动态模式配置，使用句向量模型（SBERT、Doc2Vec）生成查询上下文嵌入，并通过卷积神经网络（CNN）、随机森林和多层感知机进行分类。系统设计支持生产环境部署，采用ONNX Runtime优化与并行处理。评估显示，该方法在多种攻击场景下准确率超过95%，有效抵御SQL注入、命令注入、XSS及DoS、SSRF攻击。研究成果提供了一种鲁棒且可扩展的GraphQL安全增强方案。
原文摘要 · Abstract (English)
GraphQL's flexibility, while beneficial for efficient data fetching, introduces unique security vulnerabilities that traditional API security mechanisms often fail to address. Malicious GraphQL queries can exploit the language's dynamic nature, leading to denial-of-service attacks, data exfiltration through injection, and other exploits. Existing solutions, such as static analysis, rate limiting, and general-purpose Web Application Firewalls, offer limited protection against sophisticated, context-aware attacks. This paper presents a novel, AI-driven approach for real-time detection of malicious GraphQL queries. Our method combines static analysis with machine learning techniques, including Large Language Models (LLMs) for dynamic schema-based configuration, Sentence Transformers (SBERT and Doc2Vec) for contextual embedding of query payloads, and Convolutional Neural Networks (CNNs), Random Forests, and Multilayer Perceptrons for classification. We detail the system architecture, implementation strategies optimized for production environments (including ONNX Runtime optimization and parallel processing), and evaluate the performance of our detection models and the overall system under load. Results demonstrate high accuracy in detecting various threats, including SQL injection, OS command injection, and XSS exploits, alongside effective mitigation of DoS and SSRF attempts. This research contributes a robust and adaptable solution for enhancing GraphQL API security.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。