用大模型生成恶意SQL语句，测试防火墙防御能力。
Adversarial SQL Injection Generation with LLM-Based Architectures
- 设计两个大模型系统，结合检索增强与反思链式推理生成攻击语句。
- 对10种防火墙测试240次，生成24万条语句，最高绕过率达22.73%。
- 发现少样多样语句反而更易绕过AI类防火墙，适合安全研究人员参考。
SQL注入攻击仍是OWASP十大威胁之一。随着大语言模型（LLMs）的发展，自动化生成对抗性攻击测试成为可能。本文提出两种新型基于LLM的攻击生成系统：面向对抗性SQL注入的检索增强生成（RADAGAS）和反思链式思维SQL注入（RefleXQLi），并与现有基线方法在10个Web应用防火墙（WAFs）及1个基于执行的MySQL验证器上进行对比。测试涵盖6个规则型开源WAF（ModSecurity PL1–3，Coraza PL1–3）、2个基于AI/ML的WAF（WAF Brain，CNN-WAF）以及2个商业WAF（AWS WAF，Cloudflare WAF）。使用GPT-4o、Claude 3.7 Sonnet和DeepSeek R1作为模型，共执行240组实验，生成24万条载荷，对WAF进行220万次测试。结果表明，RADAGAS-GPT4o在所有基线中表现最优，绕过率高达22.73%。其变体在基于AI/ML的WAF上表现优异（如RADAGAS-DeepSeek对WAF-Brain绕过率达92.49%，RADAGAS-Claude对CNN-WAF达80.48%），但在规则型WAF（如ModSecurity、Coraza）上仅能绕过0–5.70%。此外，生成较少多样性载荷反而提升绕过成功率，但若初始载荷无效则整体效果差。研究为大模型在安全测试中的应用提供了全面评估视角。
原文摘要 · Abstract (English)
SQL injection (SQLi) attacks are still one of the serious attacks ranked in the Open Worldwide Application Security Project (OWASP) Top 10 threats. Today, with advances in Artificial Intelligence (AI), especially in Large Language Models (LLMs), an opportunity has been created for automating adversarial attack tests to measure the defense mechanisms. In this paper, we aim to create a comprehensive evaluation of use cases that utilize LLMs for adversarial SQL injection generation. We introduce two novel LLM-based systems, Retrieval Augmented Generation for Adversarial SQLi (RADAGAS) and Reflective Chain-of-Thought SQLi (RefleXQLi), and compare them with existing baselines against 10 Web Application Firewalls (WAFs) and one execution-based MySQL validator. To perform a comprehensive test, we used six rule-based open-source WAFs (ModSecurity PL1--3, Coraza PL1--3), 2 AI/ML-based WAFs (WAF Brain, CNN-WAF), and 2 commercial WAFs (AWS WAF and Cloudflare WAF). For the LLM models, we used GPT-4o, Claude 3.7 Sonnet, and DeepSeek R1. Our tests consist of 240 experiments that generate 240,000 payloads and perform 2.2 million tests against WAFs. Our comprehensive evaluation reveals that RADAGAS-GPT4o outperforms other baseline models with a 22.73\% bypass rate. The proposed RADAGAS variants are highly successful on AI/ML-based WAFs (92.49\% on WAF-Brain by RADAGAS-DeepSeek, 80.48\% on CNN-WAF by RADAGAS-Claude), but struggle to bypass rule-based WAFs (0--5.70\% on ModSecurity and Coraza). In addition to these findings, another observation is that creating less diverse payloads achieves more bypasses, however they show poor results if the initially chosen payload is not successful. We observe that our findings provide a comprehensive view on using LLM-based approaches in security testing.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。