A search enhancement-based SQL injection adversarial sample generation method

Abstract

The application discloses a kind of based on search enhancement SQL injection counter sample generation method, belong to traffic analysis and network security technical field.The application is divided into two links, first collect multiple sets of public traffic data set extraction SQL injection load, generate counter sample by a variety of variation mode, after structured cleaning, vectorization process builds SQL injection counter sample knowledge base.Second, rely on search enhancement generation technology, search similar sample and variation strategy in knowledge base, guide large language model iteration generates new counter sample, and effective sample is supplemented to knowledge base.Finally, normal traffic, original malicious sample and new counter sample are fused to construct training set, and the adversarial training of traffic detection model is completed.The application can improve the diversity and generation efficiency of counter sample, effectively strengthen the recognition ability and overall robustness of detection model to SQL injection variation attack.

Description

Technical Field

[0001] This invention belongs to the fields of traffic analysis and network security technology, and specifically relates to a method for generating SQL injection adversarial samples based on retrieval enhancement. Background Technology

[0002] With the widespread adoption of web applications, malicious traffic detection has become a key technology for ensuring their security. However, existing malicious traffic detection methods still face the following challenges: First, while some existing deep learning models have been applied to malicious traffic detection, most models tend to be unstable when dealing with complex attack patterns, especially when facing adversarial attacks targeting the detection model, making them susceptible to bypassing or misjudgment. To improve model robustness, some methods attempt to use adversarial examples for training, but existing methods still fall short in terms of the efficiency of adversarial example generation and training. Particularly in the adversarial example generation process for complex attack patterns such as SQL injection, existing techniques fail to fully utilize advanced generation techniques for efficient training, resulting in poor model adaptability in real-world environments.

[0003] Second, existing adversarial example generation methods typically rely on fixed rule bases or simple mutation strategies, resulting in limited sample diversity and difficulty in covering real-world attack variants. Furthermore, traditional generation methods lack effective utilization of historical attack samples, hindering knowledge accumulation and intelligent evolution, leading to low-quality generated adversarial examples and limited training effectiveness.

[0004] Third, existing methods lack the ability to deeply model the semantic structure of attacks during adversarial example generation. Most methods separate adversarial example generation from the semantic relationship of SQL queries, ignoring the deep connection between attack intent and behavior, making it difficult for generated samples to maintain semantic consistency. At the same time, traditional methods fail to effectively utilize the empirical knowledge from historical successful attack cases and lack a mechanism for continuous accumulation and reuse of attack strategies, making the adversarial example generation process dependent on inefficient exploration methods and difficult to adapt to dynamic adversarial environments. Summary of the Invention

[0005] The present invention proposes a retrieval-enhanced method for generating SQL injection adversarial examples to address the aforementioned technical problems. This invention aims to utilize retrieval-enhanced generation technology to construct a knowledge base capable of intelligently generating high-quality adversarial examples, and through an efficient adversarial training strategy, significantly improve the robustness and adaptability of SQL injection detection models against complex adversarial attacks. The technical solution adopted in this invention is as follows: by constructing an SQL injection adversarial example knowledge base and combining it with the generation capabilities of a large language model, diverse adversarial examples can be generated; simultaneously, a retrieval enhancement mechanism is used to intelligently retrieve similar samples and mutation strategies from the knowledge base to guide the generation process, ensuring the effectiveness and diversity of adversarial examples; finally, by integrating the generated adversarial examples into the model training process, the detection model's ability to identify unknown attacks and adversarial examples is enhanced.

[0006] To achieve the above objectives, the present invention employs the following technical solution: A method for generating SQL injection adversarial examples based on retrieval enhancement includes the following steps: 1) Construct a knowledge base for SQL injection adversarial examples: Step S101: Traffic data collection and preprocessing; collect web traffic detection datasets and SQL injection sample datasets, such as CSIC2010, ECML2007, HPD, SIK, and extract SQL injection payloads; Step S102: Construct a knowledge base of SQL injection adversarial examples; use existing SQL injection adversarial example generation tools to generate corresponding SQL injection adversarial examples from the extracted SQL injection payloads, and perform structured processing and vectorized storage. 2) Adversarial example generation and adversarial training: Step S103: Generate adversarial examples for the large model; Based on the existing knowledge base, query the mutation strategies of similar samples to support the iterative generation of adversarial examples for the large model; Step S104: Adversarial training of the traffic detection model; Based on the traffic detection dataset and adversarial examples, after data preprocessing and vectorization, the traffic detection model is adversarially trained.

[0007] This invention, through a three-stage principle of knowledge base construction, retrieval-enhanced guided generation, and adversarial training, forms a complete technical closed loop from attack sample mining and intelligent evolution of adversarial samples to proactive defense of the detection model. Compared with existing technologies, this invention has the following advantages: First, the quality of generated adversarial examples is significantly improved. By constructing a knowledge base of SQL injection adversarial examples, storing the original payload, adversarial example variants, mutation strategies, and metadata, and utilizing a retrieval-enhanced generation mechanism to recall semantically similar historical successful cases, this invention guides the generation of adversarial examples by a large language model. Compared to traditional methods that rely on fixed rule bases or simple mutation strategies, the adversarial examples generated by this invention can maintain the consistency of the original attack semantics while possessing higher stealth and diversity.

[0008] Second, the efficiency and adaptability of adversarial example generation are significantly enhanced. Valid samples after evaluation are dynamically added to the knowledge base, enabling the system to continuously accumulate successful experiences and optimize retrieval and generation strategies. Compared to traditional methods that rely on manually designed rules or inefficient random exploration, this invention significantly improves generation efficiency and possesses adaptive evolutionary capabilities.

[0009] Third, the robustness and generalization ability of the detection model are enhanced. This invention employs an adversarial training strategy, mixing generated high-quality adversarial samples with original normal traffic and known malicious traffic to construct an adversarial training dataset for supervised training of the traffic detection model. By enabling the model to continuously adapt to challenging variant samples during the learning process, the decision boundaries of the model are effectively corrected and strengthened, improving its ability to identify and defend against SQL injection adversarial attacks. Attached Figure Description

[0010] Figure 1 This is an overall flowchart of a method for generating SQL injection adversarial samples based on retrieval enhancement according to the present invention; Figure 2 Flowchart for constructing a knowledge base of SQL injection adversarial examples for this invention; Figure 3 This is a flowchart of the large-scale adversarial example generation process of this invention; Figure 4 This is a flowchart of the adversarial training process for the traffic detection model of this invention; Detailed Implementation The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0011] This invention proposes a method for generating SQL injection adversarial examples based on retrieval enhancement, the overall process of which is as follows: Figure 1 As shown. To make the objectives, technical solutions, and advantages of this invention clearer, the following description is provided in conjunction with the appendix. Figure 2 To be continued Figure 4 The present invention will be further described in detail below with reference to specific embodiments.

[0012] This invention utilizes a collaborative mechanism between retrieval enhancement generation and a large language model to achieve intelligent generation and robustness enhancement of SQL injection adversarial examples. Its core principles are as follows: First, a structured knowledge base for SQL injection adversarial examples is constructed. This knowledge base not only stores the original malicious payload and its corresponding adversarial example variants, but also records the mutation strategies used to generate these variants and related metadata. Through vectorized embedding technology, the aforementioned text and structured information are mapped to a unified semantic vector space, forming a rapidly searchable knowledge index.

[0013] Secondly, the system leverages a retrieval-enhanced generation mechanism to guide adversarial example generation. When an adversarial example needs to be generated for a new original SQL injection payload, the system uses this payload as a query condition and retrieves the top K semantically similar existing cases and their associated mutation strategies from the knowledge base through near-nearest neighbor retrieval. These retrieval results are combined with the original payload to form an enhanced suggestion, which is then input into the large language model. During the generation process, the large language model not only relies on its own language understanding capabilities but, more importantly, references the retrieved historical successful mutation strategies. This allows it to generate diverse, highly concealed, and circumventable adversarial examples while maintaining the original attack semantics.

[0014] Finally, the generated high-quality adversarial examples are integrated into the training process of the detection model. An adversarial training strategy is employed, mixing original normal traffic, known malicious traffic, and the adversarial examples generated in this invention to construct an adversarial training dataset. The detection model undergoes supervised learning on this dataset. By continuously adapting to these challenging variant samples, its decision boundary is refined and strengthened, thereby significantly improving its ability to identify unknown SQL injection variants and its robustness against adversarial attacks.

[0015] This invention mainly comprises two core stages: the first stage is to construct a knowledge base of SQL injection adversarial examples, specifically including steps S101-S102; the second stage is to generate adversarial examples and conduct adversarial training, specifically including steps S103-S104.

[0016] 1) Construct a knowledge base for SQL injection adversarial examples, referring to... Figure 2 As shown, the specific implementation steps for building a knowledge base of SQL injection adversarial examples are as follows: Step S101: Traffic data collection and preprocessing; Raw text is collected from publicly available web traffic detection datasets, including but not limited to CSIC2010, ECML2007, HPD, and SIK. Since raw network traffic typically exists as complete HTTP request messages, this embodiment employs an automated extraction technique based on a large language model, combined with a self-consistency verification mechanism, to accurately obtain clean SQL injection payloads. Specifically, a prompt word template instruction (LLM) is defined to identify abnormal SQL fragments in the HTTP request body, URL parameters, or request headers. To prevent the "illusion" of the large model output from causing false positives for non-injection text, the system performs N independent extractions on the same HTTP sample. In this embodiment, N=5 is set. If more than three of the extracted payload strings are completely identical, the payload is determined to be a valid raw SQL injection sample through self-consistency verification. For example, the raw payload 'OR 1=1 --' is successfully extracted from a complex POST request.

[0017] Step S102: Construct a knowledge base of SQL injection adversarial examples. This involves mutating, structuring, and vectorizing the extracted original payload to establish an underlying database with semantic indexing capabilities. This step is further broken down into the following sub-steps: Step S201: SQL Injection Adversarial Sample Generation. Using existing SQL injection adversarial sample generation tools, such as SQLMap's tamper script, WAF-A-Mole, and Autospear, the original SQL injection payload extracted in step S101 is subjected to automated mutation operations. The purpose of the mutation operation is to change the syntactic appearance of the SQL statement without altering its original logical semantics. The mutation operators supported in this embodiment include, but are not limited to: Keyword obfuscation: Exploiting database parsing insensitivity, "SELECT" is mutated into "SElEcT" or "SELselECT".

[0018] Whitespace replacement: Replaces spaces with other equivalent whitespace characters or symbols, such as changing "SELECT * FROM" to "SELECT\n*\nFROM".

[0019] Inserting comments: Insert inline comments into SQL statements, such as changing "UNION SELECT" to "UNION / *!50000SELECT* / ".

[0020] Redundant padding: Adding irrelevant characters in places that do not affect execution, such as changing "OR 1=1" to "OR 'a'='a' AND 1=1".

[0021] Encoding conversion: Use multiple URL encodings, hexadecimal encoding, or Unicode encoding, such as converting the string 'admin' to 0x61646d696e.

[0022] Equivalent function or statement replacement: Replace common functions with equivalent functions that are more concealed, such as changing "version()" to "@@version", or "substr()" to "substring()".

[0023] Step S202: Structured processing, which involves normalizing and filtering the generated adversarial examples and parsing their metadata. This includes: uniformly converting to UTF-8 encoding; removing irrelevant characters such as trailing garbled text introduced by the tool; and extracting key operation types. Finally, each example is parsed into a standard JSON format containing multi-dimensional metadata.

[0024] In this embodiment, the core field information after structured processing is shown in Table 1: Table 1 Structured Data Information

[0025] Furthermore, the structured standard JSON document format is shown in Table 2: Table 2 Sample Table of SQL Injection Bypasses

[0026] Step S203: Data preprocessing, cleaning the structured dataset. First, completely duplicate variant samples are removed by hash comparison; second, samples missing key metadata such as "target database type" are filled or removed; finally, the number of samples for each attack type is counted, such as error injection, joint query injection, and delayed blind injection. For categories with fewer samples, oversampling is implemented through replication or fine-tuning strategies to balance the sample distribution of different attack types and prevent bias in the knowledge base.

[0027] Step S204: Vectorization Storage. In this embodiment, the BERT-base-uncased model, with its stronger semantic awareness, is preferred to vectorize the evaded_payloads and metadata text in the structured data. The text is input into the BERT model, and the output vector of the CLS node of its last Transformer layer is extracted as the dense semantic feature vector of this adversarial example. Subsequently, the feature vector, along with its corresponding JSON metadata, is stored in the FAISS vector database to establish an underlying index, thereby supporting high-concurrency similarity retrieval.

[0028] 2) Adversarial example generation and adversarial training, refer to Figure 3As shown, the specific implementation steps are as follows: Step S103: Large-scale adversarial example generation. This step uses retrieval-enhanced generation techniques to guide the large language model to dynamically generate more concealed and complex variant samples, avoiding the large model blindly generating invalid payloads. (Refer to...) Figure 3 As shown, this step includes: Step S301: The Top K similar samples are retrieved through a retrieval enhancement mechanism. When a new original payload to be tested is input, it is first transformed into a vector using the same BERT model. Then, an approximate nearest neighbor algorithm is used to retrieve the vectors from the vector database. This embodiment uses cosine similarity to measure the spatial semantic closeness between samples; the calculation formula is:

[0029] in This is the vector of the payload to be tested. This represents existing vectors in the knowledge base. The system matches and returns the top K adversarial samples with the highest similarity scores in the knowledge base; in this embodiment, K=3. The search results not only include these similar variant payloads but also the mutation strategies and metadata recorded when they successfully bypassed the firewall.

[0030] Step S302: The large-scale adversarial example generation system automatically combines the original payload, the retrieved Top K similar variants, and their mutation strategies to assemble dynamically enhanced prompts. The structured design of the prompts is as follows: Table 3 Bypassing Sample Production Prompts

[0031] When this prompt is input into a large language model, such as Deepseek or a locally fine-tuned Qwen model, the large model can output novel adversarial examples with extremely high quality and complex mutation features because the prompt contains accurate historical successful strategies.

[0032] Step S303: Evaluate the samples and provide feedback. Input the candidate adversarial samples generated by the large model into the locally deployed syntax parser for semantic equivalence verification, such as using Python's sqlparse library. If the mutated statement cannot be parsed in terms of syntax structure, or if it breaks the original attack chain logic, the large model determines whether it is an invalid sample and discards it if necessary.

[0033] For valid adversarial examples, they are input into a sandbox environment containing regular WAF rules. If a bypass is successfully achieved, the example and its derived mutation strategies are converted into standard JSON format and dynamically added to the knowledge base in step S102 to achieve adaptive expansion of the knowledge base.

[0034] Step S104: Adversarial Training of the Traffic Detection Model Existing traffic detection models are enhanced by generating diverse adversarial examples, making their decision boundaries more robust. (Refer to...) Figure 4 As shown, this step includes: Step S401: Construct a traffic detection dataset. Integrate normal HTTP requests from the public dataset with positive payloads and labels of 0, and malicious SQL injection requests with negative payloads and labels of 1.

[0035] Next, the historical adversarial samples in the knowledge base of step S102 and the newly generated adversarial samples in step S103 are merged and injected as negative samples.

[0036] To ensure that the false positive rate for normal traffic does not spike due to an excessive number of adversarial examples during model training, this embodiment strictly controls the proportions of the dataset. The final adversarial training dataset comprises: 60% normal HTTP requests, 20% traditional malicious requests, and 20% generated high-quality SQL adversarial examples.

[0037] Step S402: Data Preprocessing and Structured Representation. Deeply analyze the HTTP requests in the adversarial training dataset. Extract text fields including the request line, request headers, and request body. Perform standardized preprocessing, including URL decoding, case normalization, and removal of redundant transport layer control characters.

[0038] After cleaning, text representation models, such as TextCNN based on bidirectional feature extraction or pre-trained BERT deep networks, are used to convert the cleaned text paragraphs into fixed-dimensional feature matrices. For example, the text is truncated or padded into token sequences of uniform length 256 and mapped to a two-dimensional real matrix, which serves as the standard input for downstream traffic detection models.

[0039] Step S403: Adversarial Training. The static adversarial training dataset constructed above is randomly divided into training set, validation set and test set in a ratio of 8:1:1.

[0040] Within a supervised learning framework, a traffic detection model is configured, such as a bidirectional LSTM model with an attention mechanism. In each training iteration, a data stream containing normal, malicious, and adversarial variants is fed into the model in batches, with a specific batch size of 64.

[0041] The residuals between the predicted and true labels are calculated using the cross-entropy loss function, and backpropagation is performed using the AdamW optimizer to dynamically update the network weights. During training, the model not only learns the explicit features of conventional SQL injection, but also approximates and repairs the originally fragile classification boundary through adversarial examples, gaining a deeper understanding of complex avoidance behaviors such as "using comment symbols to cut keywords" and "encoding deception".

[0042] The model is trained iteratively over multiple epochs until the loss function converges on the validation set. The resulting enhanced traffic detection model maintains a very high recognition rate against various unknown and highly disguised SQL injection variants, significantly improving the system's proactive defense capabilities in real-world dynamic network adversarial environments.

Claims

1. A method for generating SQL injection adversarial examples based on retrieval enhancement, characterized in that, Includes the following steps: 1) Construct a knowledge base for SQL injection adversarial examples: Step S101: Traffic data collection and preprocessing; Collect web traffic detection datasets and SQL injection sample datasets, such as CSIC2010, ECML2007, HPD, and SIK, and extract SQL injection payloads; Step S102: Construct a knowledge base of SQL injection adversarial examples; use existing SQL injection adversarial example generation tools to generate corresponding SQL injection adversarial examples from the extracted SQL injection payloads, and perform structured processing and vectorized storage. 2) Adversarial example generation and adversarial training: Step S103: Generate adversarial examples for the large model; Based on the existing knowledge base, query the mutation strategies of similar samples to support the iterative generation of adversarial examples for the large model; Step S104: Adversarial training of the traffic detection model; Based on the traffic detection dataset and adversarial examples, the traffic detection model is adversarially trained after data preprocessing and vectorization.

2. The method according to claim 1, characterized in that, In step S101, the Web traffic detection dataset includes the CSIC2010 dataset and the ECML2007 dataset. Based on large language model extraction and self-consistency verification, the SQL injection payload is obtained from the traffic samples.

3. The method according to claim 1, characterized in that, Step S102 includes: S201: Use an SQL injection adversarial sample generation tool to mutate the original SQL injection payload and generate a semantically equivalent SQL injection adversarial sample.

4. The method according to claim 3, characterized in that, The mutation operation includes at least one of the following: Keyword obfuscation, whitespace replacement, case conversion, comment insertion, redundancy padding, encoding conversion, and equivalent function or statement replacement.

5. The method according to claim 1, characterized in that, Step S102 further includes: S202: The generated adversarial sample is structured, including uniform encoding, removal of irrelevant characters, token normalization, and finally parsed into a JSON format containing metadata of the original payload, mutation strategy, attack type, and target database type.

6. The method according to claim 1, characterized in that, Step S102 further includes: S203: Perform data preprocessing on the structured adversarial samples, including removing duplicate samples, handling missing values, and balancing the sample distribution of different attack types.

7. The method according to claim 1, characterized in that, Step S102 further includes: S204: Pre-trained models such as Bag-of-Words, TF-IDF, Word2Vec, and BERT are used for vectorization to convert adversarial examples into vector representations and store them in a vector database.

8. The method according to claim 1, characterized in that, Step S103 includes: S301: Use the approximate nearest neighbor algorithm to retrieve the Top K similar adversarial samples corresponding to the input payload in the knowledge base; S302: Input the original payload, the Top K similar adversarial samples and the corresponding mutation strategies to construct prompt words into the large language model to generate new adversarial samples; S303: Evaluate the generated adversarial examples and add valid examples to the knowledge base.

9. The method according to claim 8, characterized in that, In step S301, cosine similarity or Euclidean distance is used to calculate sample similarity, and the corresponding mutation strategy and metadata are returned.

10. The method according to claim 1, characterized in that, Step S104 includes: S401: Integrate the SQL-related payloads from the public dataset and merge them with the SQL injection adversarial samples generated in steps S102 and S103 to construct an adversarial training dataset containing normal requests, malicious requests, and SQL injection adversarial samples. S402: Data preprocessing and structured representation. After standardizing, denoising, truncating, and padding the SQL-related payloads in the dataset, the BERT or TextCNN model is used to convert them into fixed-dimensional feature vectors as model inputs. S403: Adversarial training. A pre-built static adversarial training dataset is divided into training, validation, and test sets according to a certain ratio. The traffic detection model is trained using this dataset in a standard supervised manner to optimize the loss function. During the training process, the model learns to mix normal requests, malicious requests, and adversarial examples to improve its ability to identify SQL mutation attacks and its robustness.

Images