Abstract:

With the continuous evolution of web applications and widespread deployment of database-driven systems, SQL injection attacks remain a critical research focus in web security defense due to their highly covert and destructive nature. To address challenges posed by structural complexity, semantic diversity, and scarcity of attack samples in SQL injection attack statements, this paper proposed a novel detection method integrating graph structure modeling with reinforcement learning mechanisms. The proposed approach models SQL statements as graph structures and leverages an enhanced Graph Attention Network (GAT) to fuse syntactic features from nodes and edges. A multi-agent reinforcement learning framework incorporating four specialized detection experts was constructed to enable dynamic ensemble decision-making. Additionally, an adversarial sample generation module specifically designed for SQL injection obfuscation characteristics enhanced the model’s capability in identifying complex mutation attacks. Furthermore, explainability analysis using LIME and SHAP methods improved system transparency and practical applicability. Experimental results demonstrate that the proposed method effectively mitigates detection bias caused by sample imbalance and attack pattern diversification while maintaining low computational resource consumption. The method achieves 0.955 detection accuracy and 0.978 AUC on comprehensive SQL injection datasets, significantly outperforming existing baseline methods and providing an effective solution for intelligent SQL injection attack detection.

Key words: SQL injection detection, graph attention network, multi-agent, DQN, interpretable reinforcement learning