Review reveals efficacy of machine learning in anomaly detection and behavioral profiling for SQL queries, suggesting advancements beyond traditional methods.
SQL injection and data exfiltration remain among the most severe threats to relational database security, often leading to critical data breaches in enterprise systems. This review explores the application of machine learning techniques for detecting such threats by profiling the behavioral patterns of relational SQL queries. Unlike traditional rule-based approaches, machine learning models enable the dynamic identification of anomalous query structures and access behaviors indicative of malicious intent. The study synthesizes recent advancements in supervised, unsupervised, and deep learning methods tailored for query classification, anomaly detection, and user behavior modeling. Furthermore, it evaluates the efficacy of these techniques in detecting stealthy exfiltration attacks under evolving threat landscapes. Emphasis is placed on data preprocessing strategies, feature extraction from SQL logs, and the use of graph-based and sequence-aware models for enhanced detection accuracy. The review concludes by outlining emerging challenges such as adversarial query generation, concept drift, and the need for explainable models in high-assurance environments.
No takes yet. Share an insight, caveat, or question.
Balogun et al. (2025) studied this question.
Synapse has enriched 5 closely related papers on similar clinical questions. Consider them for comparative context: