Multi-Agent Honeypot-Based Request-Response Context Dataset for Improved SQL Injection Detection Performance
Fuente:
arXiv
Saved in:
| Main Authors: | , , , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2026
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866911482323664896 |
|---|---|
| author | Yu, Hao Li, Hui Shi, FengYuan Yu, Wenjie Ho, PinHan Wang, Zehua Wang, Bin |
| author_facet | Yu, Hao Li, Hui Shi, FengYuan Yu, Wenjie Ho, PinHan Wang, Zehua Wang, Bin |
| contents | SQL injection remains a major threat to web applications, as existing defenses often fail against obfuscation and evolving attacks because of neglecting the request-response context. This paper presents a context-enriched SQL injection detection framework, focusing on constructing a high-quality request-response dataset via a multi-agent honeypot system: the Request Generator Agent produces diverse malicious/benign requests, the Database Response Agent mediates interactions to ensure authentic responses while protecting production data, and the Traffic Monitor pairs requests with responses, assigns labels, and cleans data, yielding totally 140,973 labeled pairs with contextual cues absent in payload-only data. Experiments show that models trained on this context dataset outperform payload-only counterparts: CNN and BiLSTM achieve over 40\% accuracy improvement in different tasks, validating that the request-response context enhances the detection of evolving and obfuscated attacks. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2603_02963 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | Multi-Agent Honeypot-Based Request-Response Context Dataset for Improved SQL Injection Detection Performance Yu, Hao Li, Hui Shi, FengYuan Yu, Wenjie Ho, PinHan Wang, Zehua Wang, Bin Cryptography and Security K.6.5; I.2.6 SQL injection remains a major threat to web applications, as existing defenses often fail against obfuscation and evolving attacks because of neglecting the request-response context. This paper presents a context-enriched SQL injection detection framework, focusing on constructing a high-quality request-response dataset via a multi-agent honeypot system: the Request Generator Agent produces diverse malicious/benign requests, the Database Response Agent mediates interactions to ensure authentic responses while protecting production data, and the Traffic Monitor pairs requests with responses, assigns labels, and cleans data, yielding totally 140,973 labeled pairs with contextual cues absent in payload-only data. Experiments show that models trained on this context dataset outperform payload-only counterparts: CNN and BiLSTM achieve over 40\% accuracy improvement in different tasks, validating that the request-response context enhances the detection of evolving and obfuscated attacks. |
| title | Multi-Agent Honeypot-Based Request-Response Context Dataset for Improved SQL Injection Detection Performance |
| topic | Cryptography and Security K.6.5; I.2.6 |
| url | https://arxiv.org/abs/2603.02963 |