SQL Injection Detection Method Based on Multi-Dimensional Feature Modeling and Deep Learning

• Shuai Wang,
• Xinqian Liu,
• Huixue Liu,
• Chuan Zhao,
• Jianguo Ding,

Vol. 20, No. 1, January 31, 2026
10.3837/tiis.2026.01.021, Download Paper (Free):

• cybersecurity
• SQL injection detection
• Deep Learning
• feature extraction

Abstract

Structured Query Language (SQL) injection attacks remain among the most severe and prevalent cybersecurity threats, which enable attackers to manipulate databases, disclose sensitive information, and even compromise entire systems. To address the limitations of feature representation and generalization about existing detection approaches, this study proposes an SQL injection detection method based on multi-dimensional numerical feature modeling and deep learning. Firstly, this method provides a detailed fine-grained segmentation of SQL injection categories for the first time, such as stacked query injection and boolean-based blind injection. Next, a comprehensive feature system with multiple perspectives is constructed to capture diverse query behaviors. And this system includes character distribution, syntactic structure, keyword usage, and function invocation. Then, multiple feature optimization strategies, such as Recursive Feature Elimination (RFE), Recursive Feature Addition (RFA), Random Forest Feature Importance (RF-FI), and Autoencoder-based compression, are integrated to enhance model efficiency and robustness. Finally, based on a combined dataset of 188,363 SQL queries, experimental results demonstrate that the proposed method achieves substantial improvements over existing baseline algorithms. Specifically, under the binary classification task, the best-performing model (RFA-DNN) attains an accuracy of 97.99%, a precision of 98.91%, a recall of 98.17%, and an F1-score of 98.53%, which surpasses the baseline GWO model by more than 21.3% in F1-score. For the multi-class task, the proposed approach achieves a macro F1-score of 94.56% using only 50% of the original feature dimensions. These results verify the superior detection accuracy, robustness, and scalability, and this method provides an effective and generalizable solution for real-world SQL injection defense.

Statistics

Cite this article