CodeBERT Detection Pipeline for SQL Injection Detection: A Comparison with other ML Models

• Leonardo Antonetti da Motta USP
• Alan Demétrius Baria Valejo UFSCar
• Lina Garcés USP

DOI: https://doi.org/10.5753/sbseg.2026.28969

Resumo

SQL injection (SQLi) remains a prevalent web application vulnerability, while existing detection approaches often struggle to generalise across obfuscated and long SQL payloads. This paper presents CodeBERT-SQLi, a CodeBERT-based detection pipeline that adapts transformer models to arbitrary-length queries through sliding-window tokenisation and majority-vote aggregation. We compile and standardise a large-scale SQLi corpus from ten public sources to produce a unified dataset of 12.7 million labelled queries. We then conduct a comparative evaluation involving CodeBERT-SQLi, untuned BERT and CodeBERT, and traditional ML baselines (Logistic Regression, Random Forest, Linear SVM). Experiments on the complete 1.9-million-query test partition show that CodeBERT-SQLi achieves MCC = 0.947 and AUC = 0.971, outperforming all compared methods. The results further reveal that code-domain pre-training (∆MCC = 0.059) contributes more to performance gains than task-specific fine-tuning (∆MCC = 0.026), highlighting representation quality as the key factor in SQLi detection.

Palavras-chave: SQL Injection, CodeBERT, Web Application Security, Vulnerability Detection, Security Testing, Machine Learning

Referências

Alain, G. and Bengio, Y. (2017). Understanding intermediate layers using linear classifier probes. In ICLR Workshop.

Alghawazi, M., Alghazzawi, D., and Alarifi, S. (2023). Deep learning architecture for detecting SQL injection attacks based on RNN autoencoder model. Mathematics, 11(15):3286.

Alyasiri, H. and Al-Araji, Z. H. (2025). SQL injection attack dataset. Mendeley Data, v1. License: CC BY 4.0.

Ben Ammar, B. and Alharbi, A. M. (2025). SQL injection detection using fine-tuned CodeBERT. Engineering, Technology & Applied Science Research, 15(5):27852–27857.

Chicco, D. and Jurman, G. (2020). The advantages of the matthews correlation coefficient (MCC) over F1 score and accuracy in binary classification evaluation. BMC Genomics, 21(1):6.

Devlin, J., Chang, M.-W., Lee, K., and Toutanova, K. (2019). BERT: Pre-training of deep bidirectional transformers for language understanding. In Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, pages 4171–4186. Association for Computational Linguistics.

Farea, A. A., Wang, C., Farea, E., and Alawi, A. B. (2021). Cross-site scripting (XSS) and SQL injection attacks multi-classification using bidirectional LSTM recurrent neural network. In 2021 IEEE International Conference on Progress in Informatics and Computing (PIC), pages 358–363. IEEE. IEEE Xplore doc. 9687064. [link].

Feng, Z., Guo, D., Tang, D., Duan, N., Feng, X., Gong, M., Shou, L., Qin, B., Liu, T., Jiang, D., and Zhou, M. (2020). CodeBERT: A pre-trained model for programming and natural languages. In Findings of the Association for Computational Linguistics: EMNLP 2020, pages 1536–1547. Association for Computational Linguistics.

Fu, M. and Tantithamthavorn, C. (2022). LineVul: A transformer-based line-level vulnerability prediction. In Proceedings of the 19th International Conference on Mining Software Repositories (MSR), pages 608–620. IEEE.

Halfond, W. G. J., Viegas, J., and Orso, A. (2006). A classification of SQL-injection attacks and countermeasures. In Proceedings of the IEEE International Symposium on Secure Software Engineering (ISSSE).

Hanif, H. and Maffeis, S. (2022). VulBERTa: Simplified source code pre-training for vulnerability detection. In Proceedings of the International Joint Conference on Neural Networks (IJCNN), pages 1–8. IEEE.

Hasan, M., Balbahaith, Z., and Tarique, M. (2019). Detection of SQL injection attacks: A machine learning approach. In Proceedings of the 2019 International Conference on Electrical and Computing Technologies and Applications (ICECTA), pages 1–6. IEEE.

Hussain, S. S. (2021). SQL injection dataset (SQLiV3). Kaggle. [link].

Issakhani, M., Huang, M., Tayebi, M. A., and Lashkari, A. H. (2023a). BCCC-SFU-SQLInj-2023: SQL injection attack dataset. Behaviour-Centric Cybersecurity Center (BCCC), York University / Simon Fraser University.

Issakhani, M., Huang, M., Tayebi, M. A., and Lashkari, A. H. (2023b). An evolutionary algorithm for adversarial SQL injection attack generation. In 2023 IEEE International Conference on Intelligence and Security Informatics (ISI), Charlotte, NC, USA. IEEE.

Joshi, A. and Geetha, V. (2014). SQL injection detection using machine learning. In Proceedings of the 2014 International Conference on Control, Instrumentation, Communication and Computational Technologies (ICCICCT), pages 1111–1115. IEEE.

Kaldi, A. (2024). SQL injection dataset. Kaggle. [link].

Liu, M., Li, G., and Chen, J. (2020). DeepSQLi: Deep semantic learning for testing SQL injection. In Proceedings of the 29th ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA), pages 286–297. ACM.

Loshchilov, I. and Hutter, F. (2019). Decoupled weight decay regularization. In International Conference on Learning Representations (ICLR).

Mathew, A. (2021). SQL-data: Dataset for SQL injection detection. GitHub. [link] //github.com/ajinmathew/SQL-data.

Mullick, M. A. O., Ratul, R. R., Sharif, S. B., Anannaya, S. J., and Shibly, M. M. A. (2026). Rule-based SQL injection (RbSQLi) dataset. Mendeley Data, v5. License: CC BY 4.0.

OWASP Foundation (2021). OWASP top ten 2021. [link]. Accessed: 2026-05-13.

OWASP Foundation (2024). OWASP modsecurity core rule set. [link]. Accessed: 2026-05-13.

Quetel, G., Pautet, L., Alata, É., Robert, T., and Gimenez, P.-F. (2025). Superviz25-SQL: SQL injection detection dataset. Zenodo, v2. License: MIT.

Rayten (2024). SQL injection dataset. Kaggle. [link]. License: Apache 2.0.

Ross, K., Moh, M., Moh, T.-S., and Yao, J. (2018). Multi-source data analysis and evaluation of machine learning techniques for SQL injection detection. In Proceedings of the ACMSE 2018 Conference, pages 1–8.

Sajid (2021). SQL injection dataset. Kaggle. [link].

Shar, L. K. and Tan, H. B. K. (2013). Predicting SQL injection and cross site scripting vulnerabilities through mining input sanitisation patterns. Information and Software Technology, 55(10):1767–1780.

Trinity, A. (2022). SQL injection extended dataset. Kaggle. [link]. License: CC0 Public Domain.

Tripathy, D., Gohil, R., and Halabi, T. (2020). Detecting SQL injection attacks in cloud SaaS using machine learning. In 2020 IEEE 6th International Conference on Big Data Security on Cloud (BigDataSecurity), IEEE International Conference on High Performance and Smart Computing (HPSC) and IEEE International Conference on Intelligent Data and Security (IDS), pages 145–150. IEEE.

Yu, G. (2023). Biggest SQL injection dataset. Kaggle. [link].