A Multi-Layered Framework for SQL Injection Mitigation Using Machine Learning and Deceptive Techniques

Abstract

SQL Injection (SQLi) remains a pervasive and severe threat to the security of modern web applications. Exploiting flaws in input handling, these attacks allow adversaries to manipulate backend queries, gain unauthorized access to sensitive databases, and potentially compromise entire systems. This study introduces a comprehensive defense mechanism that integrates machine learning with established coding best practices to detect, prevent, and mislead SQLi attempts. Using a Naïve Bayes classifier, the system analyzes HTTP request patterns to identify anomalies indicative of injection attacks. This adaptive detection model evolves by learning from emerging threat signatures, thereby enhancing its accuracy over time. To complement detection, prevention techniques such as input sanitization, parameterized queries, and the use of real escape string functions are employed to neutralize entry points.

Additionally, the architecture incorporates a deception component that redirects suspicious activity to simulated database environments. This enables secure observation of attacker behavior without endangering real systems. By unifying adaptive detection, robust prevention, and strategic deception, the proposed solution significantly strengthens application-level security and offers resistance to both known and novel forms of SQLi. It represents a holistic approach to safeguarding web systems against one of the most enduring cybersecurity challenges.