Detecting SQL and NoSQL injection in HTTP request payloads using BERT-based models: A unified detection framework with continual learning

SQL injection (SQLi) and NoSQL injection (NoSQLi) remain major security threats to modern web applications. Although recent studies have applied machine learning and Transformer-based models to injection detection, most focus on a single attack type or analyze SQL queries rather than HTTP request payloads, while continual adaptation across SQLi and NoSQLi detection tasks remains largely unexplored. This paper proposes a unified semantic-based framework for detecting both SQLi and NoSQLi directly from HTTP request payloads using BERT-based models. To emulate realistic web application and REST API environments, HTTP request payloads are synthesized from representative HTTP GET, HTTP POST, cURL GET, and cURL POST interaction scenarios. Five pre-trained BERT models, representing general-purpose, cybersecurity-oriented, and code-oriented language models, are compared with conventional TF-IDF-based machine learning classifiers under four learning strategies: zero-shot evaluation, task-specific learning, continual learning, and rehearsal-based joint training. Experimental results demonstrate that, although all models exhibited comparable zero-shot performance, task-specific learning significantly improved detection capability, and the BERT-based models consistently outperformed conventional machine learning classifiers, achieving average detection accuracies above 90% across all subsequent experimental settings. Under continual learning, the BERT-based models exhibited only modest performance degradation, demonstrating their ability to retain most previously learned knowledge while adapting to new attack types. Rehearsal-based joint training further improved unified detection by jointly learning both attack types within a single model. Rather than identifying a universally superior learning strategy, this study provides practical deployment guidelines for selecting appropriate learning strategies according to different web application scenarios.