SQL injection detection using self-supervised pre-training and multimodal techniques

Most existing studies on SQL injection attack (SQLIA) detection using self-supervised pre-training adopt a unimodal approach, relying solely on HTTP request information. However, given the increasing sophistication of SQLIAs, dependence on a single data modality may be insufficient to provide a comprehensive understanding of such attacks. In this paper, we propose SQLIA detection framework combining self-supervised pre-training and multimodal learning, the former to reduce dependence on labelled datasets and latter to harness diverse sources of information to generate robust representation of SQLIAs. Our methodology involves pre-training two models on unlabelled HTTP request texts using computer vision and natural language processing self-supervised techniques. We extract structural and contextual features from a publicly available unlabelled web attack dataset, employing a convolutional neural network and transformer encoder as the learning algorithms in the self-supervised pre-training stage. We transfer the pre-trained models to a multimodal SQLIA dataset comprising hybrid features, enabling a more thorough representation of the attacks. By simulating SQLIAs on a private network, we generate synthetic multimodal web attack dataset (MWAD), comprising (i) textual features to fine-tune the pre-trained models and (ii) statistical packet flow features to train classical ML classifiers. By combining the fine-tuned pre-trained models and the classical ML models using a late fusion technique, the experimental results show that our proposed multimodal approach outperforms existing studies which rely on a single data modality for SQLIA detection. These results exemplify that, integrating self-supervised pre-trained text models with models trained on network flow-based information, enable the joint learning of text and behavioural features of HTTP requests for effective detection of SQLIAs.