\documentclass[conference]{IEEEtran}
\IEEEoverridecommandlockouts
% The preceding line is only needed to identify funding in the first footnote. If that is unneeded, please comment it out.
\usepackage[utf8]{inputenc}
\usepackage{cite}
\usepackage{amsmath,amssymb,amsfonts}
\usepackage{algorithmic}
\usepackage{graphicx}
\usepackage{textcomp}
\usepackage{xcolor}
\usepackage{multirow}
\def\BibTeX{{\rm B\kern-.05em{\sc i\kern-.025em b}\kern-.08em
    T\kern-.1667em\lower.7ex\hbox{E}\kern-.125emX}}
\begin{document}

\title{Comparative Analysis of SQLi Detection Models\\
}

\author{
\IEEEauthorblockN{
Gegentana Altanhuyag\IEEEauthorrefmark{1},
Enkhtur Tsogbaatar\IEEEauthorrefmark{1},
Odonchimeg Lkhagva\IEEEauthorrefmark{1},
Gantuya Gantumur\IEEEauthorrefmark{2}, \\
Dashdorj Yamkhin\IEEEauthorrefmark{1},
Uyangaa Khuchit\IEEEauthorrefmark{1},
Junxu Wei\IEEEauthorrefmark{1}
}
\IEEEauthorblockA{
\IEEEauthorrefmark{1}\textit{Department of Cybersecurity, SICT, MUST}, Ulaanbaatar, Mongolia \\
\IEEEauthorrefmark{2}\textit{Open Education Center, MUST}, Ulaanbaatar, Mongolia\\
gegeentana@gmail.com, \{enkhtur, odno, dashdorj, uyangaakh\}@must.edu.mn, gantuya@pubcert.mn, crounswei@live.cn
}
}

\maketitle

\begin{abstract}
Structured Query Language (SQL) injection (SQLi) remains a common and ongoing threat to web applications. Although numerous SQLi detection models have been proposed, comparative results reported in the literature are often inconsistent, even when evaluated on similar public datasets, making it difficult to draw reliable conclusions about the relative effectiveness of different modeling paradigms. 

In this study, we conduct a controlled comparison of representative machine learning (ML) and deep learning (DL) models on two publicly available SQL injection datasets that differ substantially in scale and composition. The ML pipeline is built on a hybrid feature representation that integrates character-level and word-level term frequency–inverse document frequency (TF–IDF) features with dense numeric behavioral indicators. In parallel, the DL models operate on normalized token sequences and include recurrent architectures, attention-augmented variants, and a Transformer-based model.

Based on the experimental results, we observe that dataset scale plays a significant role in shaping the relative behavior of ML and DL-based SQL injection detectors. On the smaller corpus, several ML models achieve performance comparable to, or exceeding, DL-based approaches, while an LSTM model with multi-head attention performs best among the evaluated DL architectures. In contrast, on the larger and more heterogeneous corpus, the Transformer attains the highest $F1_{\text{macro}}$ score of 0.9946. Across both settings, the Linear Support Vector Classifier (LinearSVC) remains a stable and competitive ML baseline. 

\end{abstract}

\begin{IEEEkeywords}
SQL injection detection, machine learning, deep learning, LinearSVC, Transformer, TF--IDF, tokenization, web application security.
\end{IEEEkeywords}

\section{Introduction}

Structured Query Language (SQL) injection (SQLi) remains a persistent security risk for web applications. By manipulating improperly validated input, attackers can alter backend query logic, retrieve sensitive information, or escalate privileges within the database environment. Despite improvements in secure development practices, SQLi continues to appear in the Open Web Application Security Project (OWASP) Top 10~\cite{owasp2021} and in newly reported Common Vulnerabilities and Exposures (CVE) reports such as CVE-2025-25257~\cite{cve25257} and CVE-2025-1094~\cite{cve1094}, indicating that the vulnerability continues to have practical impact.

Existing approaches to SQL injection detection span a range of modeling strategies, including rule-based filters as well as machine learning (ML) and deep learning (DL) methods. Rule-based systems are typically effective at identifying known attack signatures but tend to degrade under obfuscation or novel payload patterns. In contrast, ML and DL approaches learn decision boundaries directly from data, enabling greater flexibility at the cost of increased dependence on training data quality and scale. Sequence-based DL models further exploit token ordering and structural context, although this often comes with higher computational and data requirements.

A practical challenge observed in recent SQL injection detection studies is that reported performance can vary substantially across datasets, even when similar modeling approaches are employed. In particular, models that achieve strong results on small or relatively homogeneous query corpora do not always exhibit comparable behavior when evaluated on larger or more diverse datasets. This variability is further compounded by differences in preprocessing pipelines, tokenization strategies, and evaluation protocols, which are often under-specified or inconsistent across studies.

To explore this issue, we develop separate ML and DL pipelines and evaluate them on two widely used publicly available SQLi datasets. The goal is to examine how representative models behave across datasets with differing characteristics and to provide a clearer picture of the strengths and limitations of each paradigm in controlled and reproducible evaluation settings.

\section{Related Work} 

Research on SQLi detection has increasingly shifted from rule-based heuristics to data-driven modeling. A recent review of SQL injection and data-exfiltration detection published between 2020 and 2025 highlights the growing shift toward ML-based approaches, spanning supervised classifiers, sequence-aware neural models, and unsupervised anomaly detectors. It emphasizes behavioral profiling and structural modeling of SQL queries as the main trends in contemporary systems~\cite{balogun2025}. 

Non–query-based methods, such as flow-level telemetry or log-derived datasets, rely on environment-specific or synthetic traffic and often lack publicly reproducible corpora~\cite{crespo2023flowdata,muhammad2022sqli_ml,chen2021sqli_dl}, which has pushed most recent studies toward publicly available query-level datasets such as Kaggle. 

Results reported on small-scale Kaggle SQL injection datasets remain highly sensitive to modeling and preprocessing choices, leading to inconsistent conclusions about which modeling paradigm is most effective. Gated Recurrent Unit (GRU)–based detectors that rely on G-test token filtering lose ordering and structural cues essential for modeling SQL syntax~\cite{vadisetty2024intelligent}. In contrast, autoencoder-derived dense features have been reported to outperform Long Short-Term Memory (LSTM) baselines on the same corpus~\cite{thalji2023aenet}, while Convolutional Neural Network (CNN)–based models achieve high accuracy yet suffer sharp drops in F1-score~\cite{alghawazi2023rnnautoencoder}. Moreover, term frequency–inverse document frequency (TF–IDF)–based LSTM and GRU models obtain substantially lower accuracy when evaluated on the same small dataset~\cite{alazzawi2023}, underscoring the instability of sequence models under constrained data regimes.

More advanced architectures explore multi-view learning~\cite{kakisim2024}, probabilistic neural networks (PNN)~\cite{alarfaj2023}, or semantic-aware Transformer models~\cite{lu2023semantic} and CNN–attention models~\cite{lo2025lightweight}. Table~\ref{tab:relatedwork} summarizes representative SQLi detection studies along the dimensions of method, data source, performance, and key limitations. However, many of these systems rely on private or composite datasets with incomplete preprocessing details, making direct comparison challenging. This motivates evaluating representative ML and DL pipelines on multiple public SQLi datasets within a controlled experimental setting that limits confounding effects and enables meaningful cross-dataset comparison.

\begin{table*}[!t]
\centering
\caption{Representative SQL injection detection studies (2021--2025).}
\begin{tabular}{|p{4.0cm}|p{3.0cm}|p{2.0cm}|p{4.8cm}|}
\hline
\textbf{Solution} & \textbf{Data Source} & \textbf{Metric} & \textbf{Key Limitation} \\
\hline

Flow-based ML~\cite{crespo2023flowdata} &
Synthetic network flow data (NetFlow v5) &
97.3\% Acc. &
No payload semantics; synthetic and environment-specific traffic. \\
\hline

Log-based ML~\cite{muhammad2022sqli_ml} &
Damn Vulnerable Web Application (DVWA) logs (synthetic) &
98.43\% Acc. &
Very small, synthetic dataset; environment-dependent. \\
\hline

Word2Vec + CNN/Multilayer Perceptron (MLP)~\cite{chen2021sqli_dl} &
Private HTTP logs &
$>98\%$ Acc. &
Private dataset; preprocessing details not disclosed. \\
\hline

G-test filtering + GRU~\cite{vadisetty2024intelligent} &
Kaggle &
96.65\% Acc. &
Token ordering removed; highly sensitive to preprocessing. \\
\hline

Autoencoder-based Network (AE-Net) + Extreme Gradient Boosting (XGBoost)~\cite{thalji2023aenet} &
Kaggle &
99\% Acc. &
Costly feature generation; comparison relies on weak LSTM baseline. \\
\hline

Recurrent Neural Network (RNN) autoencoder~\cite{alghawazi2023rnnautoencoder} &
Kaggle &
94\% Acc. &
Information loss due to sequence compression in the autoencoder bottleneck. \\
\hline

TF--IDF-based LSTM/GRU classifiers~\cite{alazzawi2023} &
Kaggle &
90.11\% Acc. &
TF--IDF features discard sequential structure; sequence models offer limited benefit under this representation. \\
\hline

Multi-view Bidirectional Long Short-Term Memory (BiLSTM)--CNN~\cite{kakisim2024} &
Multi-source &
96.96\% Acc. &
Architecturally complex; high computational overhead. \\
\hline

Probabilistic Neural Network (PNN) with Bat Algorithm (BAT)–based smoothing parameter optimization~\cite{alarfaj2023} &
Synthetic dataset &
99.2\% Acc. &
Small synthetic dataset; heuristic-dependent design. \\
\hline

synBERT~\cite{lu2023semantic} &
Mixed corpora &
99.6\% F1 &
Dataset construction under-specified, making independent replication difficult. \\
\hline

Lightweight CNN--attention~\cite{lo2025lightweight} &
Kaggle &
98.98\% Acc. &
Keyword-only tokenization; limited robustness to obfuscation. \\
\hline

\end{tabular}
\label{tab:relatedwork}
\end{table*}

\section{Research Methodology}
This section describes the methodology used to develop and evaluate the ML and DL models for SQL injection detection. 

\subsection{Data Collection}
This study employs two widely used SQL injection datasets from Kaggle. Both datasets contain raw SQL queries annotated as benign (0) or malicious (1), with each record consisting of a Query field and a corresponding Label field.

Dataset A is the SQL Injection Dataset released by Rayten~\cite{rayten_sql_injection_dataset}. The files \textit{trainingdata.csv} and \textit{testingdata.csv} are used as the initial splits. Fig.~\ref{fig:class_distribution} illustrates their class distribution.

\begin{figure}[!b]
\centering{\includegraphics[width=0.45\textwidth]{fig1.png}}
\caption{Class distribution of benign and SQL injection samples.}
\label{fig:class_distribution}
\end{figure}

Dataset B is an additional SQL injection dataset~\cite{Sajid_SQLInjectionDataset_2021}, consisting of 30,919 labeled SQL queries. It is included as a smaller-scale testbed to examine whether the relative behavior of ML and DL models remains consistent under reduced data scale and complexity.

\subsection{Data Processing}

The two datasets require minor dataset-specific preprocessing prior to feature extraction and model training. Dataset~A provides predefined training and test splits and is used directly after removing empty queries and exact duplicates. Dataset~B undergoes deduplication followed by a stratified 80/20 split to preserve class balance, yielding 24,660 training samples and 6,166 test samples.

After this initial step, both datasets are processed using a unified preprocessing pipeline. This pipeline applies whitespace normalization, filters malformed or empty entries, and removes duplicates within each split, ensuring that no identical query appears in both training and test sets.

For the DL models, additional vocabulary normalization is applied to stabilize the embedding space. Variable substrings such as numbers, URLs, email addresses, file paths, and hexadecimal fragments are replaced with placeholder tokens (e.g., \texttt{<NUM>, <URL>, <EMAIL>, <PATH>, and <HEX>}), reducing vocabulary sparsity while preserving structural patterns relevant to classification.

Because SQL injection payloads often contain concatenated or obfuscated constructs, both ML and DL pipelines employ a SQL-aware tokenizer. The tokenizer performs longest-match recognition over 112 SQL keywords, segments concatenated expressions, and treats operators and delimiters as standalone tokens, producing structured token sequences for downstream processing.

\subsection{Feature Engineering}

For the ML models, feature representation follows a hybrid design that integrates lexical and behavioral indicators. Character-level TF--IDF features (1--4 grams) capture fine-grained symbol patterns and obfuscation artifacts; due to their high dimensionality, TruncatedSVD is applied to ensure computational feasibility and comparability across feature groups. Word-level TF--IDF features (1--2 grams), derived from SQL-aware tokens, encode keyword co-occurrence structure and contextual semantics. In addition, a compact set of numeric features captures query length statistics, character composition ratios, entropy-related measures, case-switch behavior, and indicators of risky functions or schema references. Together, these features model structural, statistical, and behavioral aspects of SQL injection payloads.

For the DL models, normalized tokens are mapped to integer indices using a vocabulary constructed from the training set, with unseen terms mapped to a reserved \texttt{<UNK>} symbol. Queries are truncated or padded to a fixed length of 256 tokens and passed through a trainable embedding layer that projects tokens into a 768-dimensional vector space. These embeddings serve as input to the recurrent and Transformer-based architectures evaluated in this study.

\subsection{Model Training}

For the ML branch, four representative classifiers are evaluated: Logistic Regression, Linear Support Vector Classifier (LinearSVC), Random Forest, and Stochastic Gradient Descent (SGD) Classifier. These models represent several widely used modeling paradigms for high-dimensional text classification, including linear, margin-based, ensemble, and scalable optimization approaches. All ML models are trained using five-fold stratified cross-validation on the training set, followed by refitting on the full training data with selected hyperparameters and a single evaluation on the test split.

For the DL branch, sequential neural architectures are trained on tokenized query sequences, including LSTM, GRU, and Transformer-based models. Recurrent variants augmented with self-attention and multi-head attention are included to examine the contribution of attention mechanisms. All DL models are trained with an internal validation split from the training data, using identical optimization settings and early stopping criteria to ensure methodological consistency across architectures.

\subsection{Model Evaluation}
In binary classification, model predictions can be summarized by the confusion matrix, which decomposes outcomes into true positives (TP), true negatives (TN), false positives (FP), and false negatives (FN). Based on these quantities, the following metrics are used:
\begin{align}
\text{Accuracy} &= \frac{TP + TN}{TP + TN + FP + FN}, \\
\text{Precision} &= \frac{TP}{TP + FP}, \\
\text{Recall} &= \frac{TP}{TP + FN}, \\
\text{F1-score} &= \frac{2 \times \text{Precision} \times \text{Recall}}{\text{Precision} + \text{Recall}}.
\end{align}
Accuracy measures the proportion of correctly classified samples. Precision quantifies the fraction of predicted positives that are correct, and Recall measures the fraction of actual positives that are identified. The F1-score is the harmonic mean of Precision and Recall and is commonly used in detection tasks.

The main metric in this study is the macro-averaged F1-score ($F1_{\text{macro}}$), which computes the F1-score separately for each class and then takes the unweighted mean:
\begin{equation}
F_{1\text{-}macro} = \frac{1}{N}\sum_{i=1}^{N} F_{1i},
\end{equation}
where $N$ denotes the number of classes. This averaging strategy ensures that both benign and injection classes contribute equally to the final score, preventing the evaluation from being dominated by the majority class.

To complement $F1_{\text{macro}}$, the Area Under the Receiver Operating Characteristic Curve (AUC--ROC) is reported. AUC--ROC measures the ability of a classifier to separate positive and negative samples across varying decision thresholds by summarizing the trade-off between the True Positive Rate (TPR) and False Positive Rate (FPR). Higher AUC--ROC values indicate stronger threshold-independent discriminative performance.

\section{Experimental Results}
This section reports the evaluation results on two datasets, referred to as Dataset~A and Dataset~B. All models are evaluated on their corresponding held-out test partitions using $F1_{\text{macro}}$ and AUC--ROC.

\subsection{Results of Machine Learning Models}

Table~\ref{tab:ml-combined} summarizes the performance of the machine learning models on Dataset~A and Dataset~B. On Dataset~A, LinearSVC achieves the best balance between $F1_{\text{macro}}$ and AUC--ROC, benefiting from the hybrid feature representation that integrates character-level, word-level, and numeric descriptors. The corresponding confusion matrix in Fig.~\ref{fig:cm_linearsvc} exhibits strong diagonal dominance, indicating stable generalization.

On Dataset~B, all ML models achieve consistently high performance across metrics. LinearSVC remains the most stable classifier, reaching an $F1_{\text{macro}}$ of 0.9983, while Random Forest attains the highest AUC--ROC. The overall performance convergence suggests that Dataset~B presents more separable feature patterns, enabling linear and ensemble classifiers to approach near-perfect discrimination.

\begin{figure}[!t]
\centerline{\includegraphics[width=0.40\textwidth]{fig2.png}}
\caption{Confusion matrix of the LinearSVC classifier on Dataset~A}
\label{fig:cm_linearsvc}
\end{figure}

\begin{table}[!t]
\centering
\caption{Performance of Machine Learning Models}
\label{tab:ml-combined}
\resizebox{\columnwidth}{!}{
\begin{tabular}{|c|cc|cc|}
\hline
\multirow{2}{*}{\textbf{Model}} 
& \multicolumn{2}{c|}{\textbf{Dataset A}} 
& \multicolumn{2}{c|}{\textbf{Dataset B}} \\
\cline{2-5}
& \textbf{F1\_macro} & \textbf{AUC--ROC} 
& \textbf{F1\_macro} & \textbf{AUC--ROC} \\
\hline
Logistic Regression & 0.9862 & 0.9996 & 0.9969 & 0.9992 \\
\hline
\textbf{LinearSVC} & \textbf{0.9927} & 0.9996 & \textbf{0.9983} & 0.9994 \\
\hline
SGDClassifier & 0.9744 & 0.9987 & 0.9956 & 0.9986 \\
\hline
Random Forest & 0.9856 & \textbf{0.9999} & 0.9981 & \textbf{0.9999} \\
\hline
\end{tabular}
}
\end{table}


\subsection{Results of Deep Learning Models}

Table~\ref{tab:dl-a} and Table~\ref{tab:dl-b} report the performance of the evaluated deep learning models on Dataset~A and Dataset~B. Across both datasets, all evaluated architectures achieve strong detection performance, with $F1_{\text{macro}}$ values exceeding 0.98.

On Dataset~A, the Transformer model achieves the highest $F1_{\text{macro}}$ score among all evaluated architectures. The impact of attention mechanisms on recurrent models is mixed: while the LSTM with self-attention slightly improves over the vanilla LSTM, both GRU-based attention variants and the LSTM with multi-head attention exhibit lower $F1_{\text{macro}}$ scores than their corresponding base models. Fig.~\ref{fig:dl_performance_comparison} provides a comparative overview of $F1_{\text{macro}}$, Accuracy, AUC--ROC across the evaluated models.

On Dataset~B, performance differences among deep learning models are substantially smaller. Attention-augmented LSTM and GRU variants achieve the top $F1_{\text{macro}}$ performance on Dataset B, although the margins over vanilla recurrent models and the Transformer are narrow. In this setting, the relative ranking of architectures converges, with multiple models achieving near-identical performance levels.

\begin{table}[!t]
\centering
\caption{Performance of Deep Learning Models on Dataset A}
\label{tab:dl-a}
\resizebox{\columnwidth}{!}{
\begin{tabular}{|c|c|c|c|}
\hline
\textbf{Model} & \textbf{F1\_macro} & \textbf{Accuracy} & \textbf{AUC-ROC} \\
\hline
LSTM & 0.9926 & 0.9926 & 0.9998 \\
\hline
\textbf{Transformer} & \textbf{0.9946} & \textbf{0.9946} & 0.9977 \\
\hline
GRU & 0.9918 & 0.9919 & 0.9953 \\
\hline
GRU + Self-Attention & 0.9809 & 0.9810 & 0.9994 \\
\hline
GRU + Multi-Head Attention & 0.9897 & 0.9897 & 0.9991 \\
\hline
LSTM + Self-Attention & 0.9938 & 0.9937 & 0.9990 \\
\hline
LSTM + Multi-Head Attention & 0.9893 & 0.9893 & \textbf{0.9998} \\
\hline
\end{tabular}
}
\end{table}

\begin{table}[!t]
\centering
\caption{Performance of Deep Learning Models on Dataset B}
\label{tab:dl-b}
\resizebox{\columnwidth}{!}{
\begin{tabular}{|c|c|c|c|}
\hline
\textbf{Model} & \textbf{F1\_macro} & \textbf{Accuracy} & \textbf{AUC-ROC} \\
\hline
LSTM + Multi-Head Attention & 0.9964 & 0.9967 & 0.9996 \\
\hline
LSTM + Self-Attention & 0.9959 & 0.9963 & 0.9995 \\
\hline
GRU + Multi-Head Attention & 0.9959 & 0.9963 & 0.9994 \\
\hline
LSTM & 0.9955 & 0.9959 & 0.9991 \\
\hline
GRU + Self-Attention & 0.9955 & 0.9959 & 0.9995 \\
\hline
Transformer & 0.9951 & 0.9955 & 0.9990 \\
\hline
GRU & 0.9942 & 0.9947 & 0.9994 \\
\hline
\end{tabular}
}
\end{table}

\begin{figure*}[!t]
\centering
\includegraphics[width=\textwidth]{fig3.png}
\caption{Comparison of deep learning models on Dataset~A across macro F1-score, classification accuracy, and area under the ROC curve.}
\label{fig:dl_performance_comparison}
\end{figure*}

\subsection{Comparative Analysis and Discussion}

To contextualize the observed performance trends, we compare our findings with several representative recent studies that adopt different modeling and preprocessing strategies for SQL injection detection. The lightweight attention-based model in~\cite{lo2025lightweight}, trained on a corpus comparable in scale to Dataset~A, demonstrates that compact self-attention modules can achieve competitive performance under large-data conditions. Under a similar regime, our Transformer attains stronger results ($F1_{\text{macro}} = 0.9946$), suggesting that full self-attention more effectively exploits broader token diversity and longer query structures.

By contrast, the studies in~\cite{vadisetty2024intelligent} and~\cite{alghawazi2023rnnautoencoder} operate on a smaller-scale SQL injection dataset comparable to Dataset~B and apply dimensionality reduction through G-test token filtering or autoencoder-based compression. Both report notably lower performance. Under the same dataset scale but without feature pruning, all of our ML and DL models achieve $F1_{\text{macro}} > 0.994$. This discrepancy suggests that the degradation observed in prior work is more likely attributable to information loss introduced during preprocessing rather than to inherent limitations of the model architectures.

Cross-dataset results further illustrate that the impact of attention varies across model families. On the larger and more heterogeneous Dataset~A, the Transformer consistently outperforms recurrent variants, while LSTM augmented with self-attention improves upon the plain LSTM. In contrast, GRU-based attention variants do not yield consistent gains, possibly due to the GRU’s compact gating structure, where additional attention may introduce mild overfitting or calibration shifts when the decision boundary is already well separable.

On the smaller and more regular Dataset~B, both ML and DL models converge to similarly high performance. This convergence reflects the dataset’s limited lexical and structural variability rather than an intrinsic advantage of any specific model family. Overall, these results emphasize that dataset characteristics and preprocessing choices play a dominant role in determining both performance ceilings and relative model rankings.


\subsection{Feature Importance Analysis}

To assess the relative contribution of different feature groups, we conducted an ablation study, permutation importance analysis, and coefficient-based interpretation using LinearSVC.

In the ablation study, removing character-level TF--IDF reduces $F1_{\text{macro}}$ from 0.9927 to 0.9900, while removing word-level TF--IDF leads to a larger drop (0.9842). Excluding numeric features results in the most substantial degradation (0.9493). When used in isolation, numeric descriptors perform best (0.9515), followed by word-level (0.9178) and character-level representations (0.7865), confirming that the hybrid design captures complementary signals.

Permutation importance results show that shuffling numeric features produces the largest performance drop (0.2640±0.0017), followed by word-level (0.1084±0.0015) and character-level features (0.0558±0.0014). After normalization, numeric descriptors account for 61.7\% of total importance despite consisting of only 35 dimensions, indicating high information density.

Coefficient-based interpretation further supports this trend. Word-level TF--IDF yields the largest aggregate coefficient magnitude due to its high dimensionality, whereas numeric features exhibit the highest mean absolute weight per feature (0.9737), followed by character-level TF--IDF (0.5969). Sparsity patterns also differ, with 57.9\% zero coefficients for word-level features and only 17.1\% for numeric features.

Fig.~\ref{fig:integrated_importance} shows consistent feature rankings across all three analyses, with numeric and word-level features contributing 47.3\% and 45.9\% of overall importance, respectively. These results explain why the hybrid representation achieves strong performance: dense behavioral indicators (numeric), contextual lexical structure (word-level), and fine-grained symbol patterns (character-level) jointly reinforce classification robustness.

\begin{figure*}[!t]
\centering
\includegraphics[width=\textwidth]{fig4.png}
\caption{Summary of feature-group importance for LinearSVC. (a) Method-wise normalized importance from ablation, permutation importance, and coefficient-based analysis. (b) Aggregated overall importance ranking.}
\label{fig:integrated_importance}
\end{figure*}

\section{Conclusion and Future Work}

This study provides a controlled comparative evaluation of representative machine learning and deep learning models for SQL injection detection under a consistent preprocessing and tokenization pipeline. Across two datasets of different scales, both paradigms achieve strong performance, with the best-performing models exceeding an $F1_{\text{macro}}$ score of 0.99. The results show that well-engineered ML classifiers with hybrid feature representations remain competitive and robust baselines, while attention-based neural architectures, particularly Transformers, better exploit structural diversity and longer query patterns in larger and more heterogeneous datasets.

Beyond the comparison of aggregate performance metrics, the experimental results indicate that preprocessing and feature design have a substantial influence on the observed behavior of SQL injection detection models. In particular, feature-level analysis shows that dense numeric behavioral indicators provide strong discriminative capability, while word-level and character-level lexical representations contribute complementary contextual information. The combination of these feature groups enables robust classification across different dataset scales.

The results further suggest that performance discrepancies reported in prior studies may be partly attributed to differences in dataset characteristics and preprocessing pipelines rather than to fundamental limitations of specific model architectures. This observation is consistent with the cross-dataset trends observed in our controlled evaluation.

Future work will focus on extending the evaluation to more challenging settings, including robustness analysis against adversarially obfuscated SQL injection payloads and assessment of generalization on additional datasets. Further investigation into representation learning techniques that reduce reliance on handcrafted preprocessing is also planned, with the goal of improving robustness under practical deployment conditions.

\bibliographystyle{IEEEtran}
\bibliography{references}

\vspace{12pt}

\end{document}
