Hackers and malware are one step ahead of cybersecurity experts, and every time technology is released to the market, vulnerabilities will be quickly discovered and exploited.

How effective can machine learning technology be particularly in the defense against SQL Injection Attacks (SQLi)? Is it the correct approach to the problem?


1 Answer 1


Machine learning technology is certainly better in scope compared to signature based systems. To your example about SQLi attacks, signatures could look for specific commands/strings within the HTTP payload as means for detection. ML based approach can, instead, define the behavior as process spawned on the db server or unwanted read-only operations etc etc. If there is another novel SQLi attack which escapes the signature (string did not match) but the consequential behavior remains same (process spawned or unwanted read-only operations), then ML approach will come out flying.

Having said that, the ML based approach can only detect a behavior it is trained for. In the above example, if the SQLi attack results in a new reverse tunnel opened to another host, but we did not train the model for this behavior, then the ML approach will not succeed either.

(Answer to the previous question on how signature systems differ from ML based systems)

Yes. Signature checks only for a specific vulnerability and multiple vulnerabilities at best. Machine learning, however, focuses on the behavior of the attack which does not necessarily mean how the exploit was handled, but rather post infection activity etc.

Aside: Developing ML based security systems is my daytime job.

  • How about about false positive ?is it possible to make a bigger problem be denying real user from accessing to website ?
    – R1W
    Aug 26, 2018 at 20:36
  • 1
    @R1- false positives can be expensive given the context. If the system is looking for threats and blocks user access as a consequence, then false positives will hurt.
    – sandyp
    Aug 27, 2018 at 19:56
  • Interesting examples of using reinforcement learning to implement adaptive and autonomous cyber defense are available here: github.com/Limmen/awesome-rl-for-cybersecurity
    – Limmen
    Dec 23, 2022 at 12:56

Not the answer you're looking for? Browse other questions tagged .