Source-linked AI summary
Enhancing Web Application Firewalls with BERT-GNN for SQL Injection Detection
Lilliane Linnet Musoke, Atta Badii, Ahmed Ashlam
TL;DR
SQLi detection remains difficult because conventional WAFs struggle with complex, evolving attacks and require continual maintenance. This paper combines BERT contextual embeddings with GNN structural modelling to classify SQL queries. The model achieved 99.67% accuracy and a low mean sensitivity score of 0.0037, while the authors identify limits in the reproducibility and security of some robustness evaluations.
Problem
Conventional WAFs require continual signature maintenance and struggle with complex, zero-day, false-positive, and false-negative SQLi cases.
Method
The pipeline tokenises SQL queries, uses BERT contextual embeddings as GNN node features, and classifies graph representations.
Results
99.67% accuracy was achieved, with 99.55% attack-class F1-score and a mean sensitivity score of 0.0037.
Takeaways & Limitations
The hybrid approach showed improved accuracy and robustness for detecting complex and novel SQLi attacks within WAFs.
Takeaways & Limitations
Only feature-noise robustness proved reproducible across five seeds; other single-run advantages were seed artefacts, and worst-case white-box attacks made the GNN more vulnerable.
Abstract
from arXiv · showhide
Detecting sophisticated SQL Injection (SQLi) attacks remains among the most critical challenges in web applications security. This research study has resulted in an optimised hybrid BERT-GNN pipeline with improved detection accuracy and robustness while reducing false-positive and false-negative rates. SQL queries are tokenised and encoded into contextual BERT embeddings, which then initialise the node features of a Graph Neural Network (GNN) trained to classify each query, with the architecture tuned by Optuna over accuracy, precision, recall, and F1-score. The proposed model achieved 99.67% accuracy, with 99.71% precision, 99.39% recall, and 99.55% F1-score on the attack class. A sensitivity analysis, performed by perturbing graph inputs, further assessed the model robustness and yielded a low mean sensitivity score of 0.0037, indicating stable predictions under such perturbations. The results have demonstrated the potential of a novel hybrid model that couples BERT contextual understanding with the GNN structural modelling to detect sophisticated SQLi attack vectors. For open validation, the dataset, test sets and models are made available at https://github.com/mlily2024/Final-project-SQL-injection-pipeline.
1. Introduction and Motivation
SQLi remains a major web-application threat, while conventional WAFs struggle with evolving and complex attacks. The paper proposes combining BERT contextual embeddings with GNN structural modelling to improve detection.
- SQLi can enable unauthorised access, data corruption, malware distribution, business disruption, theft, and full system compromise.
- Conventional rule- and signature-based WAFs require costly maintenance and struggle with complex, zero-day, false-positive, and false-negative cases.
- The proposed hybrid model combines BERT contextual embeddings with GNN modelling of relationships between query tokens.
- The study evaluates accuracy alongside latency and sensitivity to perturbed inputs, targeting practical deployability.
2. Related Work
Prior SQLi detection studies report strong results across machine-learning, NLP, and hybrid models, but commonly use limited data and underemphasise robustness, operational metrics, and adaptability. These gaps motivate the proposed BERT-GNN approach.
- Naive Bayes achieved 98.33% accuracy, 97.00% F1-score, 100% sensitivity, and 97.71% specificity on the Kaggle SQL Injection Dataset.
- SVM reached 94% initial accuracy on a dataset containing 1,950 malicious and 2,000 benign queries.
- AdaBoost achieved 99.4% accuracy for malicious SQLi requests targeting cloud applications and DNS servers.
- Earlier NLP and hybrid approaches reported accuracies from 84.89% to 98%, with BERT-based detection reaching 97% accuracy, 0.8% FPR, and 5.8% FNR.
- Prior studies commonly relied on limited or self-generated datasets, omitted metrics such as latency and adversarial robustness, and used static models vulnerable to evolving attacks.
3. Methodology
The methodology converts each SQL query into contextual BERT token embeddings and a token-relationship graph, then applies graph convolutions, pooling, and fully connected classification. This combines semantic content with query structure.
- BERT processes each query bidirectionally and supplies contextual embeddings that initialise GNN node features.
- Each query is represented as a graph whose token nodes are connected in a sequential, undirected chain.
- GNN: Structural Analysis: Two graph convolutional layers aggregate neighbouring-node information through ReLU activations.
- GNN: Structural Analysis: Global mean pooling aggregates node representations into one graph-level vector for query classification.
- A fully connected classifier applies softmax to the graph representation, while weighted cross-entropy accounts for class imbalance.
- The dual methodology represents both SQL-query content and structure to support detection across diverse SQLi attacks.
4. Implementation
The implementation prepares SQL queries through cleaning, class balancing, tokenisation, and graph construction before optimising and evaluating the BERT-GNN pipeline. Evaluation covers predictive metrics, latency, robustness, and the execution environment.
- Data ingestion: The SQL Injection Dataset was loaded into a Pandas DataFrame after examining its dimensions, statistics, and data types.It contains 30,919 malicious or benign instances with Query and Label features.
- Data preprocessing: Queries were lowercased, trimmed, checked for missing values, and augmented with Query_Length without removing outliers.The 99th-percentile query length was 79 words, and no missing values were found.
- Class balancing: The dataset contained 63.2% normal queries and 36.8% SQLi attacks, so balanced class weights gave greater training emphasis to the minority class.The weighting was intended to make both classes contribute comparably to the classification loss.
- Feature extraction: BERT tokenisation added [CLS] and [SEP] markers, standardised sequences to 128 tokens, and represented queries as sequential-chain graphs with tokens as nodes.The graph construction connects adjacent tokens before the model processes the query.
- Training and optimisation: Optuna searched batch size, learning rate, dropout, and hidden-layer size across 40 trials, with early stopping limiting training to twelve epochs.The model used Adam, class-weighted cross-entropy, and mini-batches during training.
- Evaluation: Evaluation measured accuracy, precision, recall, F1-score, latency, and sensitivity to perturbations of input-graph nodes.Experiments used Python with PyTorch, PyTorch Geometric, Transformers, NetworkX, Optuna, and scikit-learn on an NVIDIA Tesla T4 runtime.
5. Results
BERT-GNN achieved very high SQLi detection performance with low misclassification and sensitivity scores. Ablations show BERT provides clean accuracy, while graph structure primarily contributes robustness to feature noise.
- 99.67% accuracy was achieved, with attack-class precision of 99.71%, recall of 99.39%, and F1-score of 99.55%.The reported mean sensitivity score was 0.0037.
- 10 false positives and 21 false negatives indicate that the model correctly classified the great majority of benign and malicious queries.The authors connect the low misclassification rate to reducing missed attacks and unnecessary benign-query alerts.
- AUC reached 1.00, while training and validation losses converged over twelve epochs without the reported overfitting pattern.Training loss declined to roughly 0.001, while validation loss remained in a narrow 0.008–0.022 band.
- False positives occurred across query lengths, whereas false negatives occurred primarily among shorter queries.The authors identify concise attack vectors as an area for improving sensitivity.
- 5.1 Sensitivity analysis: 0.0037 was the mean sensitivity across 99 malicious attack-pattern graphs after random removal of about 10% of nodes.98% of graphs had sensitivity below 0.01, but graph 86 reached 0.307 when a critical token was removed.
- 5.2 Isolating the contribution of BERT and the GNN: 99.67% hybrid accuracy was effectively matched by BERT-only baselines at 99.66% and 99.73% on the identical test set.The clean-accuracy result was therefore attributed to the BERT encoder rather than the graph component.
- 5.2 Isolating the contribution of BERT and the GNN: 99.65% accuracy without edges and 99.59% with random edges remained close to 99.67% with real edges, indicating inert graph topology on this task.The model classified by pooling BERT token features, a role the [CLS] summary also fulfilled.
- 5.2 Isolating the contribution of BERT and the GNN: 0.62% and 3.42% of GNN predictions flipped under moderate and high feature noise, versus 10.04% and 24.85% for BERT-only.The authors attribute this robustness to aggregation over many token representations, which averages out per-token noise.
6. Conclusions
The study delivered an optimised hybrid BERT-GNN model for SQLi detection in WAFs, achieving high accuracy and attack-class F1 while reporting low sensitivity to input perturbations.
- 99.67% accuracy and 99.55% attack-class F1-score were achieved by the proposed BERT-GNN model.
- A 0.0037 mean sensitivity score indicated robustness to input perturbations.
- The approach paired BERT contextual embeddings with GNN structural modelling for SQLi detection in web-application WAFs.
- The dataset, test sets, and models were released for open validation.
7. Future Work
Future work should test the model on harder, more diverse traffic and improve the graph representation, adversarial robustness, short-payload detection, and computational efficiency.
- Evaluation data: Future evaluations should use non-saturated real WAF traffic, diverse payloads, and cross-dataset training and testing to measure generalisation.
- Graph representation: Richer typed structures such as syntax, parse, or dataflow graphs should replace the largely inert linear chain.
- Robustness: Robustness research should extend from random feature noise to adaptive adversaries using adversarial or certified-robustness training.
- Detection errors: Short-query false negatives could be addressed with hard-example mining, cost-sensitive losses, or short-payload augmentation.
- Efficiency: Lighter encoders should be investigated for improved deployment efficiency.