Detecting Automated SQL Injection Attacks in Flow-Based Networks: A Comparative Analysis of Deep Learning and Traditional Approaches in Sampled and Unsampled Flow Data

Abstract

SQL injections are widely recognized as highly damaging attacks, ranking among the top threats in the OWASP Top 10 list. The literature has already addressed the problem of detecting SQLIA by analyzing the payload of network packets. However, certain networks face the challenge of handling an overwhelming amount of traffic, making it computationally infeasible to inspect every network packet. Consequently, these networks resort to using lightweight flow-based protocols and implement packet sampling techniques during flow generation. This paper aims to demonstrate the feasibility of detecting SQLIA in networks utilizing flow-based protocols and implementing packet sampling. Moreover, we present evidence to support the assertion that a deep learning-based approach outperforms traditional algorithms in detecting SQLIA in networks that rely on network flows employing packet sampling.